CVE-2026-46170: mptcp: pm: ADD_ADDR rtx: free sk if last
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: ADDADDR rtx: free sk if last
When an ADDADDR is retransmitted, the sk is held in skresettimer(), and released at the end.
If at that moment, it was the last reference being held, the sk would not be freed. sockput() should then be called instead of sockput().
But that's not enough: if it is the last reference, sockput() will call skfree(), which will end up calling skstoptimersync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call skstoptimersync() on "itself".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46170?
CVE-2026-46170 has a severity level of medium, with a CVSS score of 5.5.
What systems are affected by CVE-2026-46170?
CVE-2026-46170 affects the Linux kernel, specifically the Microsoft azl3 kernel version 6.6.141.1-1.
How do I fix CVE-2026-46170?
To fix CVE-2026-46170, update your Linux kernel to the latest version where the vulnerability has been patched.
What is the impact of CVE-2026-46170?
The impact of CVE-2026-46170 can lead to memory management issues due to improper handling of socket references.
When was CVE-2026-46170 published?
CVE-2026-46170 was published on May 28, 2026.