High 7.8Published Feb 14, 2026

CVE-2026-23169mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

Updated under an hour ago (Oct 27, 2026, 8:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	141694df6573b49aa4143c92556544b4b0bbda72 builds before 338d40bab283da2639780ee3e458fb61f1567d8c; 141694df6573b49aa4143c92556544b4b0bbda72 builds before 7896dbe990d56d5bb8097863b2645355633665eb; 141694df6573b49aa4143c92556544b4b0bbda72 builds before 455e882192c9833f176f3fbbbb2f036b6c5bf555; 141694df6573b49aa4143c92556544b4b0bbda72 builds before 51223bdd0f60b06cfc7f25885c4d4be917adba94; 141694df6573b49aa4143c92556544b4b0bbda72 builds before 1f1b9523527df02685dde603f20ff6e603d8e4a1; from 141694df6573b49aa4143c92556544b4b0bbda72 before e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d	CNA record
linux linux_kernel linux:linux_kernel	from 5.11 before 5.15.201; from 5.16 before 6.1.164; from 6.2 before 6.6.125; from 6.7 before 6.12.72; from 6.13 before 6.18.9; 6.19; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c	patch
https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb	patch
https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555	patch
https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94	patch
https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1	patch
https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.