PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46015 Linux CVE debrief

A race condition in the Linux kernel's TCP stack can cause poll()/epoll_wait() waiters and blocking accept() callers to remain asleep indefinitely when a child socket is migrated from a closing listener to another socket in the same SO_REUSEPORT group. The root cause is that inet_csk_listen_stop() adds the migrated socket to the target listener's accept queue via inet_csk_reqsk_queue_add() without notifying the target listener's waiters. While nonblocking accept() works because it checks the queue directly, blocking I/O multiplexing and blocking accept() can hang. The fix adds a sk_data_ready() notification after successful migration and protects post-queue_add() dereferences with RCU read-side critical sections to handle the reference transfer to nreq->rsk_listener and potential concurrent dequeuing by another CPU.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with applications using SO_REUSEPORT for TCP load balancing, particularly those relying on blocking I/O multiplexing or blocking accept() patterns on TCP listeners.

Technical summary

The vulnerability exists in inet_csk_listen_stop() when migrating established child sockets during listener shutdown. The migration path adds the request socket to the target listener's queue without waking waiters, causing indefinite blocking for poll/epoll and blocking accept() callers. The fix ensures proper wakeup notification and adds RCU protection for concurrent access scenarios.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits when available from your Linux distribution
  • Monitor vendor security advisories for kernel package updates addressing this issue
  • If running applications that depend on SO_REUSEPORT with TCP listeners, consider temporary workarounds such as using nonblocking accept() patterns or reducing listener churn until patches are applied
  • Review application architectures for reliance on blocking poll()/epoll_wait() on TCP listeners that may undergo SO_REUSEPORT migration events

Evidence notes

CVE description confirms the vulnerability is in the Linux kernel TCP implementation. Five kernel.org stable tree commits are provided as references, indicating backports to multiple stable branches. The fix involves calling READ_ONCE(nsk->sk_data_ready)(nsk) after successful migration and wrapping post-queue_add() dereferences in rcu_read_lock()/rcu_read_unlock().

Official resources

2026-05-27