In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcp_write_data_fin When sending a DATA_FIN… (CVE-2026-98438)

The vulnerability involves the MPTCP options handling in the Linux kernel, specifically in the mptcp_write_data_fin function. When a DATA_FIN segment without data is sent, it occupies one octet of the connection-level sequence space and requires adding a DSS mapping with specific values. If checksum negotiation is enabled, the checksum must be computed and included in the packet, requiring the initial checksum data to be reset to zero. A recent kernel commit changed the behavior so that the ext_copy structure is no longer zeroed by default, causing the checksum field to remain uninitialized in this case. The fix initializes the checksum and related fields properly for this specific scenario.

Improper initialization of checksum fields in MPTCP packets could lead to malformed packets being sent, potentially causing communication issues or protocol errors. There is no indication of active exploitation or direct security compromise from this vulnerability in the provided data.

A fix has been applied to the Linux kernel to properly initialize the checksum and related fields in the mptcp_write_data_fin function. Users should update to the fixed kernel version once it is available. No other mitigation steps are indicated.