CVE-2026-23321 — Improper Update of Reference Count in Linux
Severity
3.3LOW
No vectorEPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: in-kernel: always mark signal+subflow endp as used
Syzkaller managed to find a combination of actions that was generating
this warning:
msk->pm.local_addr_used == 0
WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961
WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.…
Affected Packages4 packages
▶CVEListV5linux/linuxd93cf38fad9f66397093432b8917971a92ee0146 — c5c877e140e5f46023a74a51e577ce5edd0a4be7+7
🔴Vulnerability Details
3OSV▶
CVE-2026-23321: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to↗2026-03-25
GHSA▶
GHSA-cp65-xq47-m66j: In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: in-kernel: always mark signal+subflow endp as used
Syzkaller managed↗2026-03-25