PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46015 Linux CVE debrief

A race condition in the Linux kernel's TCP stack can cause poll()/epoll_wait() waiters and blocking accept() callers to remain asleep indefinitely when a child socket is migrated from a closing listener to another socket in the same SO_REUSEPORT group. The root cause is that inet_csk_listen_stop() adds the migrated socket to the target listener's accept queue via inet_csk_reqsk_queue_add() without notifying the target listener's waiters. While nonblocking accept() works because it checks the queue directly, blocking I/O multiplexing and blocking accept() can hang. The fix adds a sk_data_ready() notification after successful migration and protects post-queue_add() dereferences with RCU read-side critical sections to handle the reference transfer to nreq->rsk_listener and potential concurrent dequeuing by another CPU.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running Linux systems with applications using SO_REUSEPORT for TCP load balancing, particularly those relying on blocking I/O multiplexing or blocking accept() patterns on TCP listeners.

Technical summary

The vulnerability exists in inet_csk_listen_stop() when migrating established child sockets during listener shutdown. The migration path adds the request socket to the target listener's queue without waking waiters, causing indefinite blocking for poll/epoll and blocking accept() callers. The fix ensures proper wakeup notification and adds RCU protection for concurrent access scenarios.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits when available from your Linux distribution
  • Monitor vendor security advisories for kernel package updates addressing this issue
  • If running applications that depend on SO_REUSEPORT with TCP listeners, consider temporary workarounds such as using nonblocking accept() patterns or reducing listener churn until patches are applied
  • Review application architectures for reliance on blocking poll()/epoll_wait() on TCP listeners that may undergo SO_REUSEPORT migration events

Evidence notes

CVE description confirms the vulnerability is in the Linux kernel TCP implementation. Five kernel.org stable tree commits are provided as references, indicating backports to multiple stable branches. The fix involves calling READ_ONCE(nsk->sk_data_ready)(nsk) after successful migration and wrapping post-queue_add() dereferences in rcu_read_lock()/rcu_read_unlock().

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46015 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46015

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46015 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46015

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.