A blockcipher is said to have a linear factor if, for all plaintexts and keys, there is a fixed non-empty set of key bits whose simultaneous complementation leaves the exclusive-or sum of a fixed non-empty set of ciphertext bits unchanged.

doi.org/10.1007/3-540-39799-X_16
Advances in Cryptology
Centrum Wiskunde & Informatica, Amsterdam (CWI), The Netherlands

Chaum, D., & Evertse, J.-H. (1985). Cryptanalysis of DES with a reduced number of rounds: Sequences of linear factors in block ciphers. In Lecture Notes in Computer Science/Lecture Notes in Artificial Intelligence (pp. 192–211). doi:10.1007/3-540-39799-X_16