PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46158 Linux CVE debrief

A reference counting bug in the Linux kernel's Multipath TCP (MPTCP) path manager could lead to socket reference leaks during ADD_ADDR retransmission. When an ADD_ADDR message is retransmitted, the socket reference is held via sk_reset_timer(). The original code contained direct return paths that bypassed the required sock_put() call to release this reference, creating a potential resource leak. The fix consolidates cleanup to a single exit label ensuring __sock_put() is always invoked.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-08-27
Advisory published
2026-05-28
Advisory updated
2026-08-27

Who should care

Linux kernel maintainers, network administrators running MPTCP-enabled systems, and security teams tracking kernel networking subsystem vulnerabilities

Technical summary

The MPTCP (Multipath TCP) path manager in the Linux kernel contains a socket reference counting error in ADD_ADDR retransmission handling. When sk_reset_timer() holds a socket reference during retransmission, certain error return paths failed to call sock_put(), causing reference leaks. The fix introduces a unified exit label ensuring __sock_put() executes in all cases. The patch also removes a redundant NULL check and marks remaining unlikely conditions explicitly.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable kernel Git repositories to ensure proper socket reference counting in MPTCP ADD_ADDR retransmission paths
  • Monitor for kernel updates addressing this fix in distribution security advisories
  • Review MPTCP-enabled systems for potential resource exhaustion symptoms if unpatched kernels are in use

Evidence notes

The vulnerability description indicates this is a resource leak fix in MPTCP path manager ADD_ADDR retransmission handling. The fix ensures socket reference counting is properly decremented in all code paths by using a centralized exit label. The description notes the !msk check was removed as unreachable, and remaining checks marked as unlikely().

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46158 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46158

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46158 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46158

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.