CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp()
In the Linux kernel, the following vulnerability has been resolved:
net: strparser: fix skbhead leak in strpabortstrp()
When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skbhead.
That skb is not released in strpabortstrp(), which leaks the partially assembled message and can be triggered repeatedly to exhaust memory.
Fix this by freeing strp->skbhead and resetting the parser state in the abort path. Leave strpstop() unchanged so final cleanup still happens in strpdone() after the work and timer have been synchronized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46102?
CVE-2026-46102 has a risk rating of 26, indicating critical severity.
How do I fix CVE-2026-46102?
Fixing CVE-2026-46102 involves updating to the latest version of the Linux kernel where the vulnerability has been patched.
What impact does CVE-2026-46102 have on the Linux kernel?
CVE-2026-46102 can lead to a resource leak in the Linux kernel when the stream parser is aborted, affecting system stability.
Which versions of Linux are affected by CVE-2026-46102?
CVE-2026-46102 affects specific versions of the Linux kernel prior to the fixed release; please check for updates.
What is the vector for exploiting CVE-2026-46102?
CVE-2026-46102 can be exploited through malicious network traffic that triggers the stream parser abortion.