CVE-2026-23169

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A race condition exists in the mptcp_pm_nl_flush_addrs_doit() function due to improper synchronization when handling network addresses. This flaw could allow a local attacker to trigger system crashes, leading to a Denial of Service (DoS).

A moderate-severity race condition flaw was found in the Linux kernel's Multipath TCP (MPTCP) path manager netlink implementation. The list_splice_init() call in mptcp_pm_nl_flush_addrs_doit() is not RCU-safe, so a local user able to issue MPTCP netlink address-flush operations can race concurrent readers such as mptcp_pm_nl_get_local_id() or mptcp_pm_nl_is_backup(), leading to list corruption or use-after-free and a kernel crash, resulting in denial of service. Red Hat rates this flaw Moderate because exploitation requires local access, privileges to perform MPTCP netlink operations, and high race complexity, with impact limited to availability (CVSS 3.1: 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H). This differs from the upstream CVE record, which scores 7.8 assuming low attack complexity and confidentiality and integrity impact; Red Hat's assessment finds the practical impact to be denial of service only. The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt), so those products are not affected. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; the fix is currently deferred for these products, and the residual risk remains local denial of service by an attacker who already has the required local privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.