kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount

cve CVE-2026-46158 2 sources, 2 claims · Watch

Red Hat writes:
kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount the claim

Severity: MEDIUM NVD
moderate Red Hat
CVSS they disagree: 5.5 NVD
7 Red Hat
Vendor: Linux NVD
Product: Linux NVD
CWE: CWE-911 Red Hat

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Why the CVSS differs

Metric	NVD	Red Hat
Attack vector AV	local L	local L
Attack complexity AC	low L	high H
Privileges required PR	low L	low L
User interaction UI	none N	none N
Scope S	unchanged U	unchanged U
Confidentiality C	none N	high H
Integrity I	none N	high H
Availability A	high H	high H

Each source scores the same vulnerability from what it judges the attack to need. The rows marked are where they judge it differently.

Timeline

2026-05-28	first spoke of it: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely".	NVD
2026-05-28	first spoke of it: kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount	Red Hat

What it is to other things

affects	linux/linux_kernel NVD
made_by	linux NVD

In words only, so not counted until a person confirms one:

affects

linux/linux

NVD says “Linux · Linux”

Every value, with what each source said and its receipt

Property Source Said Means here

CVSS

cvss

conflict

NVD

5.5

receipt

Source: NVD
Its words: 5.5
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "f5555a6d7c472849fdf2b426e3d0a85103118793",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "e9ba34301d2e90f63f97c76ad9eb98e5250fe961",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "81d8142148164176385c279c7c1e1d581867423d",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9426265e157dd77ec237c795901ed4dea6d69b5c",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "b41dd76f3b9735096c21d3e799a2b9fe36498d57",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "acd3d3562315c99f3c0db16f0fcc5f0306638982",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "25e37407442b8766ec2cf52fb4e31b5c3d3aeeae",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9634cb35af17019baec21ca648516ce376fa10e6",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.10"
              },
              {
                "lessThan": "5.10",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.270",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.218",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.185",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.142",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.92",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.30",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.*",
                "status": "unaffected",
                "version": "7.0.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.1",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "480951DC-CB56-4EBC-91A2-355288564ED6",
                "versionEndExcluding": "6.6.142",
                "versionStartIncluding": "5.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                "versionEndExcluding": "6.12.92",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                "versionEndExcluding": "6.18.30",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                "versionEndExcluding": "7.0.7",
                "versionStartIncluding": "6.19",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new 'exit' label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the '!msk' check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\"."
      }
    ],
    "id": "CVE-2026-46158",
    "lastModified": "2026-09-14T12:17:42.110",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-05-28T10:16:31.460",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/81d8142148164176385c279c7c1e1d581867423d"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9426265e157dd77ec237c795901ed4dea6d69b5c"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/b41dd76f3b9735096c21d3e799a2b9fe36498d57"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e9ba34301d2e90f63f97c76ad9eb98e5250fe961"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/f5555a6d7c472849fdf2b426e3d0a85103118793"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-noinfo"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

CVSS

cvss

conflict

Red Hat

receipt

Source: Red Hat
Its words: 7.0
Read by: field:cvss3_score
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-46158",
  "CWE": "CWE-911",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2482639",
  "bugzilla_description": "kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-05-28T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-46158.json",
  "severity": "moderate"
}

—

CVSS vector

cvss_vector

not compared

NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

receipt

Source: NVD
Its words: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "f5555a6d7c472849fdf2b426e3d0a85103118793",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "e9ba34301d2e90f63f97c76ad9eb98e5250fe961",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "81d8142148164176385c279c7c1e1d581867423d",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9426265e157dd77ec237c795901ed4dea6d69b5c",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "b41dd76f3b9735096c21d3e799a2b9fe36498d57",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "acd3d3562315c99f3c0db16f0fcc5f0306638982",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "25e37407442b8766ec2cf52fb4e31b5c3d3aeeae",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9634cb35af17019baec21ca648516ce376fa10e6",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.10"
              },
              {
                "lessThan": "5.10",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.270",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.218",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.185",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.142",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.92",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.30",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.*",
                "status": "unaffected",
                "version": "7.0.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.1",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "480951DC-CB56-4EBC-91A2-355288564ED6",
                "versionEndExcluding": "6.6.142",
                "versionStartIncluding": "5.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                "versionEndExcluding": "6.12.92",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                "versionEndExcluding": "6.18.30",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                "versionEndExcluding": "7.0.7",
                "versionStartIncluding": "6.19",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new 'exit' label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the '!msk' check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\"."
      }
    ],
    "id": "CVE-2026-46158",
    "lastModified": "2026-09-14T12:17:42.110",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-05-28T10:16:31.460",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/81d8142148164176385c279c7c1e1d581867423d"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9426265e157dd77ec237c795901ed4dea6d69b5c"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/b41dd76f3b9735096c21d3e799a2b9fe36498d57"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e9ba34301d2e90f63f97c76ad9eb98e5250fe961"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/f5555a6d7c472849fdf2b426e3d0a85103118793"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-noinfo"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

not compared

Red Hat

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

receipt

Source: Red Hat
Its words: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Read by: field:cvss3_scoring_vector
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

2026-10-06 13:01 UTC	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
2026-09-29 09:44 UTC	—

What the source handed over

{
  "CVE": "CVE-2026-46158",
  "CWE": "CWE-911",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2482639",
  "bugzilla_description": "kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-05-28T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-46158.json",
  "severity": "moderate"
}

—

CWE

cwe

Red Hat

CWE-911

receipt

Source: Red Hat
Its words: CWE-911
Read by: field:CWE
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-46158",
  "CWE": "CWE-911",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2482639",
  "bugzilla_description": "kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-05-28T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-46158.json",
  "severity": "moderate"
}

—

Product

product

NVD

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "f5555a6d7c472849fdf2b426e3d0a85103118793",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "e9ba34301d2e90f63f97c76ad9eb98e5250fe961",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "81d8142148164176385c279c7c1e1d581867423d",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9426265e157dd77ec237c795901ed4dea6d69b5c",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "b41dd76f3b9735096c21d3e799a2b9fe36498d57",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "acd3d3562315c99f3c0db16f0fcc5f0306638982",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "25e37407442b8766ec2cf52fb4e31b5c3d3aeeae",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9634cb35af17019baec21ca648516ce376fa10e6",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.10"
              },
              {
                "lessThan": "5.10",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.270",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.218",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.185",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.142",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.92",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.30",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.*",
                "status": "unaffected",
                "version": "7.0.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.1",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "480951DC-CB56-4EBC-91A2-355288564ED6",
                "versionEndExcluding": "6.6.142",
                "versionStartIncluding": "5.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                "versionEndExcluding": "6.12.92",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                "versionEndExcluding": "6.18.30",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                "versionEndExcluding": "7.0.7",
                "versionStartIncluding": "6.19",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new 'exit' label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the '!msk' check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\"."
      }
    ],
    "id": "CVE-2026-46158",
    "lastModified": "2026-09-14T12:17:42.110",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-05-28T10:16:31.460",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/81d8142148164176385c279c7c1e1d581867423d"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9426265e157dd77ec237c795901ed4dea6d69b5c"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/b41dd76f3b9735096c21d3e799a2b9fe36498d57"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e9ba34301d2e90f63f97c76ad9eb98e5250fe961"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/f5555a6d7c472849fdf2b426e3d0a85103118793"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-noinfo"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Severity

severity

NVD

MEDIUM

From 4.0 to 6.9.

receipt

Source: NVD
Its words: MEDIUM
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	MEDIUM
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "f5555a6d7c472849fdf2b426e3d0a85103118793",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "e9ba34301d2e90f63f97c76ad9eb98e5250fe961",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "81d8142148164176385c279c7c1e1d581867423d",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9426265e157dd77ec237c795901ed4dea6d69b5c",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "b41dd76f3b9735096c21d3e799a2b9fe36498d57",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "acd3d3562315c99f3c0db16f0fcc5f0306638982",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "25e37407442b8766ec2cf52fb4e31b5c3d3aeeae",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9634cb35af17019baec21ca648516ce376fa10e6",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.10"
              },
              {
                "lessThan": "5.10",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.270",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.218",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.185",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.142",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.92",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.30",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.*",
                "status": "unaffected",
                "version": "7.0.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.1",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "480951DC-CB56-4EBC-91A2-355288564ED6",
                "versionEndExcluding": "6.6.142",
                "versionStartIncluding": "5.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                "versionEndExcluding": "6.12.92",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                "versionEndExcluding": "6.18.30",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                "versionEndExcluding": "7.0.7",
                "versionStartIncluding": "6.19",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new 'exit' label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the '!msk' check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\"."
      }
    ],
    "id": "CVE-2026-46158",
    "lastModified": "2026-09-14T12:17:42.110",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-05-28T10:16:31.460",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/81d8142148164176385c279c7c1e1d581867423d"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9426265e157dd77ec237c795901ed4dea6d69b5c"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/b41dd76f3b9735096c21d3e799a2b9fe36498d57"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e9ba34301d2e90f63f97c76ad9eb98e5250fe961"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/f5555a6d7c472849fdf2b426e3d0a85103118793"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-noinfo"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

medium

Severity

severity

Red Hat

moderate

A flaw that is harder to exploit, or whose impact is limited.

receipt

Source: Red Hat
Its words: moderate
Read by: field:severity
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-46158",
  "CWE": "CWE-911",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2482639",
  "bugzilla_description": "kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-05-28T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-46158.json",
  "severity": "moderate"
}

medium

Status

status

NVD

Modified

receipt

Source: NVD
Its words: Modified
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "f5555a6d7c472849fdf2b426e3d0a85103118793",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "e9ba34301d2e90f63f97c76ad9eb98e5250fe961",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "81d8142148164176385c279c7c1e1d581867423d",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9426265e157dd77ec237c795901ed4dea6d69b5c",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "b41dd76f3b9735096c21d3e799a2b9fe36498d57",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "acd3d3562315c99f3c0db16f0fcc5f0306638982",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "25e37407442b8766ec2cf52fb4e31b5c3d3aeeae",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9634cb35af17019baec21ca648516ce376fa10e6",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.10"
              },
              {
                "lessThan": "5.10",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.270",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.218",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.185",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.142",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.92",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.30",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.*",
                "status": "unaffected",
                "version": "7.0.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.1",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "480951DC-CB56-4EBC-91A2-355288564ED6",
                "versionEndExcluding": "6.6.142",
                "versionStartIncluding": "5.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                "versionEndExcluding": "6.12.92",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                "versionEndExcluding": "6.18.30",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                "versionEndExcluding": "7.0.7",
                "versionStartIncluding": "6.19",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new 'exit' label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the '!msk' check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\"."
      }
    ],
    "id": "CVE-2026-46158",
    "lastModified": "2026-09-14T12:17:42.110",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-05-28T10:16:31.460",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/81d8142148164176385c279c7c1e1d581867423d"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9426265e157dd77ec237c795901ed4dea6d69b5c"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/b41dd76f3b9735096c21d3e799a2b9fe36498d57"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e9ba34301d2e90f63f97c76ad9eb98e5250fe961"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/f5555a6d7c472849fdf2b426e3d0a85103118793"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-noinfo"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "f5555a6d7c472849fdf2b426e3d0a85103118793",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "e9ba34301d2e90f63f97c76ad9eb98e5250fe961",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "81d8142148164176385c279c7c1e1d581867423d",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9426265e157dd77ec237c795901ed4dea6d69b5c",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "b41dd76f3b9735096c21d3e799a2b9fe36498d57",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "acd3d3562315c99f3c0db16f0fcc5f0306638982",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "25e37407442b8766ec2cf52fb4e31b5c3d3aeeae",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              },
              {
                "lessThan": "9634cb35af17019baec21ca648516ce376fa10e6",
                "status": "affected",
                "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "net/mptcp/pm.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.10"
              },
              {
                "lessThan": "5.10",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.270",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.218",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.185",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.142",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.92",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.30",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.*",
                "status": "unaffected",
                "version": "7.0.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.1",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "480951DC-CB56-4EBC-91A2-355288564ED6",
                "versionEndExcluding": "6.6.142",
                "versionStartIncluding": "5.10",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                "versionEndExcluding": "6.12.92",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                "versionEndExcluding": "6.18.30",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                "versionEndExcluding": "7.0.7",
                "versionStartIncluding": "6.19",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new 'exit' label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the '!msk' check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\"."
      }
    ],
    "id": "CVE-2026-46158",
    "lastModified": "2026-09-14T12:17:42.110",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-05-28T10:16:31.460",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/81d8142148164176385c279c7c1e1d581867423d"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9426265e157dd77ec237c795901ed4dea6d69b5c"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/b41dd76f3b9735096c21d3e799a2b9fe36498d57"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/e9ba34301d2e90f63f97c76ad9eb98e5250fe961"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/f5555a6d7c472849fdf2b426e3d0a85103118793"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "NVD-CWE-noinfo"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

kernel: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount zetlyn/cve-redhat · 2026-05-28	cvss 7 cvss_vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H cwe CWE-911 severity moderate	source
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely". zetlyn/cve-nvd · 2026-05-28	cvss 5.5 cvss_vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H product Linux severity MEDIUM status Modified vendor Linux	source