CVE-2026-23169

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23169
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1 Patch
https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c Patch
https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555 Patch
https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94 Patch
https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb Patch
https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
History

03 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.7 		v2 : unknown
v3 : 7.8

18 Mar 2026, 14:57

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
CWE CWE-362
References () https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1 - () https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1 - Patch
References () https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c - () https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c - Patch
References () https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555 - () https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555 - Patch
References () https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94 - () https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94 - Patch
References () https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb - () https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb - Patch
References () https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d - () https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7

19 Feb 2026, 16:27

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c -
  • () https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb -

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: mptcp: corrección de condición de carrera en mptcp_pm_nl_flush_addrs_doit() syzbot y Eulgyu Kim reportaron fallos en mptcp_pm_nl_get_local_id() y/o mptcp_pm_nl_is_backup() La causa raíz es list_splice_init() en mptcp_pm_nl_flush_addrs_doit() que no está preparada para RCU. list_splice_init_rcu() no puede ser llamada aquí mientras se mantiene el spinlock pernet->lock. Muchas gracias a Eulgyu Kim por proporcionar una reproducción y probar nuestros parches.

16 Feb 2026, 10:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555 -
  • () https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94 -

14 Feb 2026, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-14 16:15

Updated : 2026-04-03 14:16

NVD link : CVE-2026-23169

Mitre link : CVE-2026-23169

CVE.ORG link : CVE-2026-23169

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')