Skip to content
Heist/ feed
Unrated

mptcp: pm: in-kernel: always mark signal+subflow endp as used

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961 WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.2.17/961 WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210, CPU#1: syz.2.17/961 Modules linked in: CPU: 1 UID: 0 PID: 961 Comm: syz.2.17 Not tainted 6.19.0-08368-gfafda3b4b06b #22 PREEMPT(full) Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.17.0-debian-1.17.0-1build1 04/01/2014 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline] RIP: 0010:mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline] RIP: 0010:mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210 Code: 89 c5 e8 46 30 6f fe e9 21 fd ff ff 49 83 ed 80 e8 38 30 6f fe 4c 89 ef be 03 00 00 00 e8 db 49 df fe eb ac e8 24 30 6f fe 90 <0f> 0b 90 e9 1d ff ff ff e8 16 30 6f fe eb 05 e8 0f 30 6f fe e8 9a RSP: 0018:ffffc90001663880 EFLAGS: 00010293 RAX: ffffffff82de1a6c RBX: 0000000000000000 RCX: ffff88800722b500 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880158b22

Announced Source revision 1
Original source ↗

CVE-2026-23321

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-23321

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "d93cf38fad9f66397093432b8917971a92ee0146",
        "lessThan": "c5c877e140e5f46023a74a51e577ce5edd0a4be7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "64815ba15880ce5f99df075fa4104fef170ac7e5",
        "lessThan": "05799c2f1ca5eb13d65764dda688d02021b65e06",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
        "lessThan": "67f34ab318807989b57dfdb0f79e2d4e57018290",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
        "lessThan": "a64aa7db39392add5be09dffaedbf1f0ce5554df",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
        "lessThan": "198824ccfa64ffebd918bf99c939bd8170a4a4d8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "85df533a787bf07bf4367ce2a02b822ff1fba1a3",
        "lessThan": "579a752464a64cb5f9139102f0e6b90a1f595ceb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f21cc29bc13e86512621727a4388c8a7ad2716b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6.1.106",
        "lessThan": "6.1.167",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.6.46",
        "lessThan": "6.6.130",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.10.5",
        "lessThan": "6.11",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "net/mptcp/pm_kernel.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.11"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.11",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.167",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.130",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.78",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.17",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.7",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/mptcp/pm_kernel.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-23321

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#27227 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement