CVE-2026-23169

mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

State: Published
Severity: 7.8 High
Published: Feb 14, 2026
Updated: Aug 5, 2026
Reserved: Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup()

Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready.

list_splice_init_rcu() can not be called here while holding pernet->lock spinlock.

Many thanks to Eulgyu Kim for providing a repro and testing our patches.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	141694df6573b49aa4143c92556544b4b0bbda72 to before 338d40bab283da2639780ee3e458fb61f1567d8cAffected 141694df6573b49aa4143c92556544b4b0bbda72 to before 7896dbe990d56d5bb8097863b2645355633665ebAffected 141694df6573b49aa4143c92556544b4b0bbda72 to before 455e882192c9833f176f3fbbbb2f036b6c5bf555Affected 141694df6573b49aa4143c92556544b4b0bbda72 to before 51223bdd0f60b06cfc7f25885c4d4be917adba94Affected 141694df6573b49aa4143c92556544b4b0bbda72 to before 1f1b9523527df02685dde603f20ff6e603d8e4a1Affected 141694df6573b49aa4143c92556544b4b0bbda72 to before e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1dAffected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.201 through 5.15.Not affected 6.1.164 through 6.1.Not affected 6.6.125 through 6.6.Not affected 6.12.72 through 6.12.Not affected 6.18.9 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

141694df6573b49aa4143c92556544b4b0bbda72 to before 338d40bab283da2639780ee3e458fb61f1567d8cAffected
141694df6573b49aa4143c92556544b4b0bbda72 to before 7896dbe990d56d5bb8097863b2645355633665ebAffected
141694df6573b49aa4143c92556544b4b0bbda72 to before 455e882192c9833f176f3fbbbb2f036b6c5bf555Affected
141694df6573b49aa4143c92556544b4b0bbda72 to before 51223bdd0f60b06cfc7f25885c4d4be917adba94Affected
141694df6573b49aa4143c92556544b4b0bbda72 to before 1f1b9523527df02685dde603f20ff6e603d8e4a1Affected
141694df6573b49aa4143c92556544b4b0bbda72 to before e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1dAffected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.201 through 5.15.*Not affected
6.1.164 through 6.1.*Not affected
6.6.125 through 6.6.*Not affected
6.12.72 through 6.12.*Not affected
6.18.9 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.