CVE-2026-68169

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) subsystem. A race condition in the mptcp_pm_userspace_get_local_id function allows a memory address entry to be freed while still being referenced. A local attacker could exploit this use-after-free vulnerability, potentially leading to a system crash (denial of service) or arbitrary code execution.

This vulnerability is rated as Moderate because successful exploitation requires local privileges to interact with the path management interface and depends on winning a tight timing race between subflow teardown and connection handshakes. In Red Hat Enterprise Linux, triggering this condition requires non-standard configurations utilizing the userspace path manager rather than the default in-kernel path manager. While an authenticated local attacker could trigger a kernel use-after-free leading to kernel memory corruption or a denial of service, the narrow execution window significantly reduces the likelihood of arbitrary code execution in practice.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.