CVE-2026-23169

mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

Published Feb 14, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()
and/or mptcp_pm_nl_is_backup()

Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()
which is not RCU ready.

list_splice_init_rcu() can not be called here while holding pernet->lock
spinlock.

Many thanks to Eulgyu Kim for providing a repro and testing our patches.

Analysis

Technical impact

A race condition was discovered in the Linux kernel's MPTCP subsystem when the function mptcp_pm_nl_flush_addrs_doit performs a list splice without the required RCU protection. This flaw allows concurrent access to a shared list, potentially corrupting memory and causing the kernel to crash. The resulting kernel panic effectively denies service on the affected host.

Affected Systems

The vulnerability exists in Linux kernel releases 6.19 release candidates (rc1 through rc7). Any system running one of these kernels without the upstream patch to mptcp_pm_nl_flush_addrs_doit is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 classifies the issue as high severity, but the EPSS of less than 1% indicates that exploitation attempts are currently rare. The risk is not reflected in the CISA KEV catalog. Based on the description, it is inferred that exploitation would likely require interaction with the MPTCP subsystem, possibly through crafted network traffic or local manipulation of MPTCP sockets, leading to a kernel panic and system reboot.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`141694df6573b49aa4143c92556544b4b0bbda72`	affected	< 338d40bab283da2639780ee3e458fb61f1567d8c
`141694df6573b49aa4143c92556544b4b0bbda72`	affected	< 7896dbe990d56d5bb8097863b2645355633665eb
`141694df6573b49aa4143c92556544b4b0bbda72`	affected	< 455e882192c9833f176f3fbbbb2f036b6c5bf555
`141694df6573b49aa4143c92556544b4b0bbda72`	affected	< 51223bdd0f60b06cfc7f25885c4d4be917adba94
`141694df6573b49aa4143c92556544b4b0bbda72`	affected	< 1f1b9523527df02685dde603f20ff6e603d8e4a1
`141694df6573b49aa4143c92556544b4b0bbda72`	affected	< e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`5.15.201`	unaffected	≤ 5.15.*
`6.1.164`	unaffected	≤ 6.1.*
`6.6.125`	unaffected	≤ 6.6.*
`6.12.72`	unaffected	≤ 6.12.*
`6.18.9`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[141694df6573b49aa4143c92556544b4b0bbda72,1f1b9523527df02685dde603f20ff6e603d8e4a1)`	affected	code_commit	—
`[141694df6573b49aa4143c92556544b4b0bbda72,e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.11`	affected	generic	—
`[0,5.11)`	unaffected	generic	—
`[6.18.9,6.19.0)`	unaffected	semver	—
`[6.19,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the fix (e.g., the commit that resolves the race condition).
If a kernel upgrade cannot be performed, disable MPTCP by setting the sysctl net.mptcp.enabled to 0 or recompiling the kernel without MPTCP support.
As a temporary fix, apply the upstream patch locally to your kernel source and rebuild the kernel to incorporate the resolution.

Generated by OpenCVE AI on April 16, 2026 at 06:48 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8570-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8594-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8604-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8605-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8570-2	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8669-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.142% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1
https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c
https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555
https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94
https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb
https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d
https://lore.kernel.org/linux-cve-announce/2026021420-CVE-2026-23169-38ea@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23169
https://www.cve.org/CVERecord?id=CVE-2026-23169

History

Apr 3, 2026 2:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mar 18, 2026 3:00 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Feb 19, 2026 4:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb

Feb 17, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021420-CVE-2026-23169-38ea@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23169 https://www.cve.org/CVERecord?id=CVE-2026-23169
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Feb 16, 2026 9:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555 https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94

Feb 14, 2026 4:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.
Title		mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1 https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d