mptcp: pm: in-kernel: always mark signal+subflow endp as used
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961 WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.2.17/961 WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210, CPU#1: syz.2.17/961 Modules linked in: CPU: 1 UID: 0 PID: 961 Comm: syz.2.17 Not tainted 6.19.0-08368-gfafda3b4b06b #22 PREEMPT(full) Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.17.0-debian-1.17.0-1build1 04/01/2014 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline] RIP: 0010:mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline] RIP: 0010:mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210 Code: 89 c5 e8 46 30 6f fe e9 21 fd ff ff 49 83 ed 80 e8 38 30 6f fe 4c 89 ef be 03 00 00 00 e8 db 49 df fe eb ac e8 24 30 6f fe 90 <0f> 0b 90 e9 1d ff ff ff e8 16 30 6f fe eb 05 e8 0f 30 6f fe e8 9a RSP: 0018:ffffc90001663880 EFLAGS: 00010293 RAX: ffffffff82de1a6c RBX: 0000000000000000 RCX: ffff88800722b500 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880158b22
CVE-2026-23321
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-23321
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d93cf38fad9f66397093432b8917971a92ee0146",
"lessThan": "c5c877e140e5f46023a74a51e577ce5edd0a4be7",
"versionType": "git"
},
{
"status": "affected",
"version": "64815ba15880ce5f99df075fa4104fef170ac7e5",
"lessThan": "05799c2f1ca5eb13d65764dda688d02021b65e06",
"versionType": "git"
},
{
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"lessThan": "67f34ab318807989b57dfdb0f79e2d4e57018290",
"versionType": "git"
},
{
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"lessThan": "a64aa7db39392add5be09dffaedbf1f0ce5554df",
"versionType": "git"
},
{
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"lessThan": "198824ccfa64ffebd918bf99c939bd8170a4a4d8",
"versionType": "git"
},
{
"status": "affected",
"version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
"lessThan": "579a752464a64cb5f9139102f0e6b90a1f595ceb",
"versionType": "git"
},
{
"status": "affected",
"version": "0f21cc29bc13e86512621727a4388c8a7ad2716b",
"versionType": "git"
},
{
"status": "affected",
"version": "6.1.106",
"lessThan": "6.1.167",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.46",
"lessThan": "6.6.130",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.10.5",
"lessThan": "6.11",
"versionType": "semver"
}
],
"programFiles": [
"net/mptcp/pm_kernel.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mptcp/pm_kernel.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-23321
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #27227 · Revision 1
- Added to Heist Feed
- Publisher date