CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: ADDADDR rtx: always decrease sk refcount
When an ADDADDR is retransmitted, the sk is held in skresettimer(). It should then be released in all cases at the end.
Some (unlikely) checks were returning directly instead of calling sockput() to decrease the refcount. Jump to a new 'exit' label to call sockput() (which will become sockput() in the next commit) to fix this potential leak.
While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required, and attack complexity is rated low.
What is the expected security impact?
The issue can cause a socket reference-count leak during ADD_ADDR retransmission handling. It is rated as having high availability impact, with no confidentiality or integrity impact.
Which systems are identified in the available data?
The affected software listing includes the Linux kernel and Microsoft azl3 kernel version 6.6.141.1-1.
Are fixed package or kernel versions provided?
No fixed version is provided in the available data. Three stable-kernel commit references are supplied for identifying the remediation.