CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix race in mptcppmnlflushaddrsdoit()
syzbot and Eulgyu Kim reported crashes in mptcppmnlgetlocalid() and/or mptcppmnlisbackup()
Root cause is listspliceinit() in mptcppmnlflushaddrsdoit() which is not RCU ready.
listspliceinitrcu() can not be called here while holding pernet->lock spinlock.
Many thanks to Eulgyu Kim for providing a repro and testing our patches.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23169?
CVE-2026-23169 has a medium severity rating due to potential crashes in the MPTCP kernel functions.
How do I fix CVE-2026-23169?
To fix CVE-2026-23169, update to the latest stable version of the Linux kernel where the vulnerability has been patched.
What does CVE-2026-23169 affect?
CVE-2026-23169 affects the Linux kernel, particularly the MPTCP implementation.
What are the risks associated with CVE-2026-23169?
The risks include system crashes and potential denial of service in systems utilizing MPTCP.
Who reported CVE-2026-23169?
CVE-2026-23169 was reported by syzbot and Eulgyu Kim.