CVE-2026-23169

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23169", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.982Z", "datePublished": "2026-02-14T16:01:32.139Z", "dateUpdated": "2026-08-05T12:20:24.946Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:24.946Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race in mptcp_pm_nl_flush_addrs_doit()\n\nsyzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()\nand/or mptcp_pm_nl_is_backup()\n\nRoot cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()\nwhich is not RCU ready.\n\nlist_splice_init_rcu() can not be called here while holding pernet->lock\nspinlock.\n\nMany thanks to Eulgyu Kim for providing a repro and testing our patches."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability requires a local attacker to send a netlink MPTCP_PM_CMD_FLUSH_ADDRS command, which requires CAP_NET_ADMIN (accessible via user namespaces but still local access). The RCU reader side can be triggered by network MPTCP connections, but the flush side requires local netlink access.\nAC:L - The attacker controls both sides of the race \u2014 they can issue the netlink flush command while simultaneously establishing MPTCP connections that trigger RCU list traversal. Since the attacker creates and controls the race condition, complexity is low.\nPR:L - The flush_addrs netlink operation uses GENL_UNS_ADMIN_PERM, which checks CAP_NET_ADMIN in the user namespace via netlink_ns_capable(). An unprivileged user can obtain this capability through user namespaces (unshare -Urn).\nUI:N - No user interaction is required. The attacker can trigger both the netlink flush and the MPTCP connection processing independently without any victim action.\nS:U - The vulnerability exists within the kernel and impacts the same security context. There is no crossing of a virtualization or sandbox boundary.\nC:H - This is a use-after-free / list corruption bug where RCU readers access freed mptcp_pm_addr_entry structures. UAF gives the attacker control over freed object contents via heap spraying, enabling arbitrary kernel memory reads.\nI:H - The use-after-free on mptcp_pm_addr_entry structures (which contain function-relevant pointers and a socket pointer) can be exploited via heap spraying to achieve arbitrary write primitives and potentially control flow hijacking.\nA:H - The corrupted list pointers and use-after-free reliably cause kernel crashes (oops/panic) as reported by syzbot, providing a straightforward denial-of-service vector."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/pm_kernel.c"], "versions": [{"version": "141694df6573b49aa4143c92556544b4b0bbda72", "lessThan": "338d40bab283da2639780ee3e458fb61f1567d8c", "status": "affected", "versionType": "git"}, {"version": "141694df6573b49aa4143c92556544b4b0bbda72", "lessThan": "7896dbe990d56d5bb8097863b2645355633665eb", "status": "affected", "versionType": "git"}, {"version": "141694df6573b49aa4143c92556544b4b0bbda72", "lessThan": "455e882192c9833f176f3fbbbb2f036b6c5bf555", "status": "affected", "versionType": "git"}, {"version": "141694df6573b49aa4143c92556544b4b0bbda72", "lessThan": "51223bdd0f60b06cfc7f25885c4d4be917adba94", "status": "affected", "versionType": "git"}, {"version": "141694df6573b49aa4143c92556544b4b0bbda72", "lessThan": "1f1b9523527df02685dde603f20ff6e603d8e4a1", "status": "affected", "versionType": "git"}, {"version": "141694df6573b49aa4143c92556544b4b0bbda72", "lessThan": "e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/pm_kernel.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.201", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.164", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.125", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.72", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.9", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.201"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.164"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.125"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.72"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c"}, {"url": "https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb"}, {"url": "https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555"}, {"url": "https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94"}, {"url": "https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1"}, {"url": "https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d"}], "title": "mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mptcp/pm_kernel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "338d40bab283da2639780ee3e458fb61f1567d8c", "status": "affected", "version": "141694df6573b49aa4143c92556544b4b0bbda72", "versionType": "git"}, {"lessThan": "7896dbe990d56d5bb8097863b2645355633665eb", "status": "affected", "version": "141694df6573b49aa4143c92556544b4b0bbda72", "versionType": "git"}, {"lessThan": "455e882192c9833f176f3fbbbb2f036b6c5bf555", "status": "affected", "version": "141694df6573b49aa4143c92556544b4b0bbda72", "versionType": "git"}, {"lessThan": "51223bdd0f60b06cfc7f25885c4d4be917adba94", "status": "affected", "version": "141694df6573b49aa4143c92556544b4b0bbda72", "versionType": "git"}, {"lessThan": "1f1b9523527df02685dde603f20ff6e603d8e4a1", "status": "affected", "version": "141694df6573b49aa4143c92556544b4b0bbda72", "versionType": "git"}, {"lessThan": "e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d", "status": "affected", "version": "141694df6573b49aa4143c92556544b4b0bbda72", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mptcp/pm_kernel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.201", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.164", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.125", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.72", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "600A89ED-86F2-48D8-BB7C-5EE7A8832FC5", "versionEndExcluding": "5.15.201", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6892F74B-3F14-4500-9652-24A2ECB04144", "versionEndExcluding": "6.1.164", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "74B70CDE-7B74-4280-BBCC-8889B8F28466", "versionEndExcluding": "6.6.125", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1A7E514-FB3C-4B6B-8046-07D5A8F04644", "versionEndExcluding": "6.12.72", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "171CFCB2-8F49-4F9E-8A67-FAC6BF45B5A2", "versionEndExcluding": "6.18.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race in mptcp_pm_nl_flush_addrs_doit()\n\nsyzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()\nand/or mptcp_pm_nl_is_backup()\n\nRoot cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()\nwhich is not RCU ready.\n\nlist_splice_init_rcu() can not be called here while holding pernet->lock\nspinlock.\n\nMany thanks to Eulgyu Kim for providing a repro and testing our patches."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmptcp: correcci\u00f3n de condici\u00f3n de carrera en mptcp_pm_nl_flush_addrs_doit()\n\nsyzbot y Eulgyu Kim reportaron fallos en mptcp_pm_nl_get_local_id() y/o mptcp_pm_nl_is_backup()\n\nLa causa ra\u00edz es list_splice_init() en mptcp_pm_nl_flush_addrs_doit() que no est\u00e1 preparada para RCU.\n\nlist_splice_init_rcu() no puede ser llamada aqu\u00ed mientras se mantiene el spinlock pernet->lock.\n\nMuchas gracias a Eulgyu Kim por proporcionar una reproducci\u00f3n y probar nuestros parches."}], "id": "CVE-2026-23169", "lastModified": "2026-06-17T10:21:01.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-14T16:15:57.147", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()", "id": "2439885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439885"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmptcp: fix race in mptcp_pm_nl_flush_addrs_doit()\nsyzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()\nand/or mptcp_pm_nl_is_backup()\nRoot cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()\nwhich is not RCU ready.\nlist_splice_init_rcu() can not be called here while holding pernet->lock\nspinlock.\nMany thanks to Eulgyu Kim for providing a repro and testing our patches."], "name": "CVE-2026-23169", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23169\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23169\nhttps://lore.kernel.org/linux-cve-announce/2026021420-CVE-2026-23169-38ea@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[141694df6573b49aa4143c92556544b4b0bbda72,1f1b9523527df02685dde603f20ff6e603d8e4a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[141694df6573b49aa4143c92556544b4b0bbda72,e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.9,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-16T06:48:08.397793+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a version that includes the fix (e.g., the commit that resolves the race condition).", "If a kernel upgrade cannot be performed, disable MPTCP by setting the sysctl net.mptcp.enabled to 0 or recompiling the kernel without MPTCP support.", "As a temporary fix, apply the upstream patch locally to your kernel source and rebuild the kernel to incorporate the resolution."], "summary": {"action": "Apply patch", "impact": "Race condition leading to kernel crash and denial of service"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in Linux kernel releases 6.19 release candidates (rc1 through rc7). Any system running one of these kernels without the upstream patch to mptcp_pm_nl_flush_addrs_doit is potentially vulnerable.", "description_and_impact": "A race condition was discovered in the Linux kernel's MPTCP subsystem when the function mptcp_pm_nl_flush_addrs_doit performs a list splice without the required RCU protection. This flaw allows concurrent access to a shared list, potentially corrupting memory and causing the kernel to crash. The resulting kernel panic effectively denies service on the affected host.", "risk_and_exploitability": "The CVSS score of 7.8 classifies the issue as high severity, but the EPSS of less than 1% indicates that exploitation attempts are currently rare. The risk is not reflected in the CISA KEV catalog. Based on the description, it is inferred that exploitation would likely require interaction with the MPTCP subsystem, possibly through crafted network traffic or local manipulation of MPTCP sockets, leading to a kernel panic and system reboot."}}}}, "created": "2026-02-16T09:44:20.386168+00:00", "updated": "2026-04-16T07:00:10.975529+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}