In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix race in mptcppmnlflushaddrs_doit()
syzbot and Eulgyu Kim reported crashes in mptcppmnlgetlocalid() and/or mptcppmnlis_backup()
Root cause is listspliceinit() in mptcppmnlflushaddrs_doit() which is not RCU ready.
listspliceinit_rcu() can not be called here while holding pernet->lock spinlock.
Many thanks to Eulgyu Kim for providing a repro and testing our patches.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23169.json"
}