Vulnerability-Lookup

GHSA-R3F7-9RJ4-J5FM

Vulnerability from github – Published: 2026-02-14 18:30 – Updated: 2026-03-18 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup()

Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready.

list_splice_init_rcu() can not be called here while holding pernet->lock spinlock.

Many thanks to Eulgyu Kim for providing a repro and testing our patches.

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-23169"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-14T16:15:57Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race in mptcp_pm_nl_flush_addrs_doit()\n\nsyzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()\nand/or mptcp_pm_nl_is_backup()\n\nRoot cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()\nwhich is not RCU ready.\n\nlist_splice_init_rcu() can not be called here while holding pernet-\u003elock\nspinlock.\n\nMany thanks to Eulgyu Kim for providing a repro and testing our patches.",
  "id": "GHSA-r3f7-9rj4-j5fm",
  "modified": "2026-03-18T15:30:40Z",
  "published": "2026-02-14T18:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23169"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-23169 (GCVE-0-2026-23169)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:01 – Updated: 2026-08-05 12:20

Title

mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/338d40bab283da263…
https://git.kernel.org/stable/c/7896dbe990d56d5bb…
https://git.kernel.org/stable/c/455e882192c9833f1…
https://git.kernel.org/stable/c/51223bdd0f60b06cf…
https://git.kernel.org/stable/c/1f1b9523527df0268…
https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 141694df6573b49aa4143c92556544b4b0bbda72 , < 338d40bab283da2639780ee3e458fb61f1567d8c (git) Affected: 141694df6573b49aa4143c92556544b4b0bbda72 , < 7896dbe990d56d5bb8097863b2645355633665eb (git) Affected: 141694df6573b49aa4143c92556544b4b0bbda72 , < 455e882192c9833f176f3fbbbb2f036b6c5bf555 (git) Affected: 141694df6573b49aa4143c92556544b4b0bbda72 , < 51223bdd0f60b06cfc7f25885c4d4be917adba94 (git) Affected: 141694df6573b49aa4143c92556544b4b0bbda72 , < 1f1b9523527df02685dde603f20ff6e603d8e4a1 (git) Affected: 141694df6573b49aa4143c92556544b4b0bbda72 , < e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d (git)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.201 , ≤ 5.15.* (semver) Unaffected: 6.1.164 , ≤ 6.1.* (semver) Unaffected: 6.6.125 , ≤ 6.6.* (semver) Unaffected: 6.12.72 , ≤ 6.12.* (semver) Unaffected: 6.18.9 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_kernel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "338d40bab283da2639780ee3e458fb61f1567d8c",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "7896dbe990d56d5bb8097863b2645355633665eb",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "455e882192c9833f176f3fbbbb2f036b6c5bf555",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "51223bdd0f60b06cfc7f25885c4d4be917adba94",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "1f1b9523527df02685dde603f20ff6e603d8e4a1",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_kernel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.125",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.72",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.9",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race in mptcp_pm_nl_flush_addrs_doit()\n\nsyzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()\nand/or mptcp_pm_nl_is_backup()\n\nRoot cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()\nwhich is not RCU ready.\n\nlist_splice_init_rcu() can not be called here while holding pernet-\u003elock\nspinlock.\n\nMany thanks to Eulgyu Kim for providing a repro and testing our patches."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability requires a local attacker to send a netlink MPTCP_PM_CMD_FLUSH_ADDRS command, which requires CAP_NET_ADMIN (accessible via user namespaces but still local access). The RCU reader side can be triggered by network MPTCP connections, but the flush side requires local netlink access.\nAC:L - The attacker controls both sides of the race \u2014 they can issue the netlink flush command while simultaneously establishing MPTCP connections that trigger RCU list traversal. Since the attacker creates and controls the race condition, complexity is low.\nPR:L - The flush_addrs netlink operation uses GENL_UNS_ADMIN_PERM, which checks CAP_NET_ADMIN in the user namespace via netlink_ns_capable(). An unprivileged user can obtain this capability through user namespaces (unshare -Urn).\nUI:N - No user interaction is required. The attacker can trigger both the netlink flush and the MPTCP connection processing independently without any victim action.\nS:U - The vulnerability exists within the kernel and impacts the same security context. There is no crossing of a virtualization or sandbox boundary.\nC:H - This is a use-after-free / list corruption bug where RCU readers access freed mptcp_pm_addr_entry structures. UAF gives the attacker control over freed object contents via heap spraying, enabling arbitrary kernel memory reads.\nI:H - The use-after-free on mptcp_pm_addr_entry structures (which contain function-relevant pointers and a socket pointer) can be exploited via heap spraying to achieve arbitrary write primitives and potentially control flow hijacking.\nA:H - The corrupted list pointers and use-after-free reliably cause kernel crashes (oops/panic) as reported by syzbot, providing a straightforward denial-of-service vector."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:24.946Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555"
        },
        {
          "url": "https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d"
        }
      ],
      "title": "mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23169",
    "datePublished": "2026-02-14T16:01:32.139Z",
    "dateReserved": "2026-01-13T15:37:45.982Z",
    "dateUpdated": "2026-08-05T12:20:24.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-R3F7-9RJ4-J5FM

CVE-2026-23169 (GCVE-0-2026-23169)

Tags

Sightings

Nomenclature

Related by attack behaviour