CVE-2026-23321: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23321 is a logic flaw in the Linux kernel's MPTCP (Multipath TCP) in-kernel path manager that causes improper reference count management, leading to kernel warnings and potential denial-of-service conditions. The vulnerability was discovered by Syzkaller fuzzing and disclosed on March 25, 2026. It affects multiple Linux kernel stable branches: 6.1.106–6.1.166, 6.6.46–6.6.129, 6.10.5–6.10.x, 6.11.1–6.12.77, 6.13–6.18.16, 6.19–6.19.6, and Linux kernel 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-911 (Improper Update of Reference Count). The flaw exists in net/mptcp/pm_kernel.c where the MPTCP path manager fails to mark dual-flag endpoints (those configured with both signal and subflow flags) as "used" during endpoint deletion. Specifically, when the MPTCP subflow limit is set to 0, an endpoint with both flags is created, an ADD_ADDR is sent (via the signal flag) but no subflow is initiated (due to the limit), and then the endpoint is removed — the local_addr_used counter underflows to zero, triggering a kernel WARN_ON in __mark_subflow_endp_available() at pm_kernel.c:1071, called through mptcp_pm_nl_del_addr_doit. The attack vector is local and requires only low privileges, exploitable via netlink commands (mptcp_pm_nl_del_addr_doit) (Red Hat Bugzilla).

A local attacker with low privileges can trigger kernel warnings and denial-of-service conditions on affected systems. The vulnerability has no confidentiality or integrity impact, but the availability impact is rated High — triggering the bug can cause system instability or a kernel crash on systems where MPTCP is in use. The attack is limited to the local system and does not enable lateral movement or data exfiltration (Red Hat CVE).

1. Precondition: Obtain local access to a vulnerable Linux system with MPTCP enabled and low-privilege user credentials.
2. Set subflow limit to 0: Use a netlink/MPTCP management tool (e.g., ip mptcp limits set subflow 0) to set the MPTCP subflow limit to zero.
3. Create dual-flag endpoint: Add an MPTCP endpoint with both signal and subflow flags (e.g., ip mptcp endpoint add <addr> signal subflow). With the subflow limit at 0, an ADD_ADDR will be sent but no subflow will be initiated.
4. Initiate an MPTCP connection: Establish a new MPTCP connection from a different address, causing the ADD_ADDR to be processed without incrementing local_addr_used.
5. Delete the endpoint: Remove the MPTCP endpoint (e.g., ip mptcp endpoint delete id <id>), triggering mptcp_pm_nl_del_addr_doit → mptcp_nl_remove_subflow_and_signal_addr → __mark_subflow_endp_available, which fires a WARN_ON due to local_addr_used == 0, potentially causing system instability or crash (Red Hat Bugzilla).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log containing WARNING: net/mptcp/pm_kernel.c:1071 or references to __mark_subflow_endp_available, mptcp_nl_remove_subflow_and_signal_addr, or mptcp_pm_nl_del_addr_doit.
• Logs: Stack traces in kernel logs showing call chains through genl_family_rcv_msg_doit, genl_rcv_msg, netlink_rcv_skb, and netlink_sendmsg originating from a low-privilege process.
• Process: Unusual processes issuing netlink/Generic Netlink (GENL) messages related to MPTCP endpoint management (ip mptcp commands or equivalent) from non-root, low-privilege users.
• Network: Unexpected MPTCP ADD_ADDR signaling on network interfaces without corresponding subflow establishment, particularly when subflow limits are set to zero (Red Hat Bugzilla).

Apply kernel updates to the following fixed versions based on your branch: 6.1.167+, 6.6.130+, 6.12.78+, 6.18.17+, or 6.19.7+. Upstream fixes are available via multiple git.kernel.org commits (e.g., 05799c2f1ca5, 198824ccfa64, 579a752464a6, 67f34ab31880, a64aa7db3939, c5c877e140e5). As an interim workaround, restrict local user access and consider disabling MPTCP if it is not required (sysctl -w net.mptcp.enabled=0). Monitor kernel logs for MPTCP-related warnings as a detection measure (Red Hat CVE, Red Hat Bugzilla).