CVE-2026-97566

A low impact flaw was found in the Linux kernel's Multipath TCP (MPTCP) in-kernel path manager. When the initial (ID 0) endpoint is removed, the removal path fails to tear down pending ADD_ADDR announcements, leaving a stale announcement list entry in memory. When the path manager later re-selects ID 0 after another signal endpoint is added, it finds the stale entry and hits a WARN_ON_ONCE assertion in mptcp_pm_announced_alloc(). A local user able to manipulate MPTCP endpoint configuration (which requires CAP_NET_ADMIN privileges) could exploit this flaw to trigger a kernel warning and, on systems configured with panic_on_warn, a kernel panic, resulting in a local denial of service. No memory corruption or privilege escalation path is demonstrated by the fix. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; for these products the fix is deferred to a future regularly scheduled kernel update because the issue is limited to a local denial of service by an already-privileged user, so the residual risk is confined to that low-impact scenario. Earlier Red Hat Enterprise Linux versions (6, 7, 8, and 9, including kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in those kernels. Although the Red Hat CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the overall severity of this flaw as Low because triggering the flaw requires local privileged access to the MPTCP control plane rather than being network reachable, and the typical consequence is a kernel warning with only a potential denial of service.