CVE-2026-23169

A moderate-severity race condition flaw was found in the Linux kernel's Multipath TCP (MPTCP) path manager netlink implementation. The list_splice_init() call in mptcp_pm_nl_flush_addrs_doit() is not RCU-safe, so a local user able to issue MPTCP netlink address-flush operations can race concurrent readers such as mptcp_pm_nl_get_local_id() or mptcp_pm_nl_is_backup(), leading to list corruption or use-after-free and a kernel crash, resulting in denial of service. Red Hat rates this flaw Moderate because exploitation requires local access, privileges to perform MPTCP netlink operations, and high race complexity, with impact limited to availability (CVSS 3.1: 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H). This differs from the upstream CVE record, which scores 7.8 assuming low attack complexity and confidentiality and integrity impact; Red Hat's assessment finds the practical impact to be denial of service only. The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt), so those products are not affected. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; the fix is currently deferred for these products, and the residual risk remains local denial of service by an attacker who already has the required local privileges.