CVE-2026-23169: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23169 is a race condition vulnerability in the Linux kernel's MPTCP (Multipath TCP) path manager implementation, specifically in the mptcp_pm_nl_flush_addrs_doit() function. The flaw was reported by syzbot and researcher Eulgyu Kim, who also provided a reproducer and tested patches. It was published on February 14, 2026, and affects Linux kernel versions from 5.11 through multiple stable branches up to 6.19-rc7. It carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). The vulnerable function mptcp_pm_nl_flush_addrs_doit() uses list_splice_init(), which is not RCU (Read-Copy-Update) safe, while holding the pernet->lock spinlock. This creates a synchronization window that can cause crashes in the related functions mptcp_pm_nl_get_local_id() and mptcp_pm_nl_is_backup(). The use of list_splice_init_rcu() is not viable in this context due to the held spinlock, requiring a different synchronization approach in the fix (Feedly, git.kernel.org).

Successful exploitation allows a low-privileged local attacker to trigger kernel crashes, resulting in a denial of service through system instability. There is no confidentiality or integrity impact — the vulnerability exclusively affects availability. The scope is limited to the local system, but repeated triggering could cause persistent instability on affected hosts running MPTCP-enabled kernels (Feedly).

Apply the appropriate patched kernel version for your branch: 5.15.201 or later, 6.1.164 or later, 6.6.125 or later, 6.12.72 or later, or 6.18.9 or later. Patches are available from the Linux kernel stable repositories and have been incorporated into Debian (DSA-6141-1, DSA-6163-1, DLA-4499-1), SUSE (SUSE-2026-21241-1), and Amazon Linux 2 (ALAS2KERNEL-5.15-2026-098/099) advisories. As a temporary workaround where patching is not immediately possible, disabling MPTCP on affected systems can reduce exposure (Feedly, git.kernel.org, Debian LTS).