CVE-2026-23169

Katalog CVE

CVSS 4.7 · Medium EPSS 0,14%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada linux kernel. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.

Rincian

Terbit di NVD

14 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1 patch
• https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c patch
• https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555 patch
• https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94 patch
• https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb patch
• https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d patch