CVE-2026-68169

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) issue exists in the mptcp pm userspace get local id() function. The problem occurs because an address entry is looked up while holding a spinlock, but the entry's ID is read after the lock has been released. This creates a race condition where a concurrent deletion can free the entry between the unlock and the read operation. This race was reproduced by overlapping an MP JOIN SYN with a MPTCP PM CMD SUBFLOW DESTROY request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.