{"id":"CVE-2026-46015","state":"PUBLISHED","title":"tcp: call sk_data_ready() after listener migration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: call sk_data_ready() after listener migration\n\nWhen inet_csk_listen_stop() migrates an established child socket from\na closing listener to another socket in the same SO_REUSEPORT group,\nthe target listener gets a new accept-queue entry via\ninet_csk_reqsk_queue_add(), but that path never notifies the target\nlistener's waiters. A nonblocking accept() still works because it\nchecks the queue directly, but poll()/epoll_wait() waiters and\nblocking accept() callers can also remain asleep indefinitely.\n\nCall READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration\nin inet_csk_listen_stop().\n\nHowever, after inet_csk_reqsk_queue_add() succeeds, the ref acquired\nin reuseport_migrate_sock() is effectively transferred to\nnreq->rsk_listener. Another CPU can then dequeue nreq via accept()\nor listener shutdown, hit reqsk_put(), and drop that listener ref.\nSince listeners are SOCK_RCU_FREE, wrap the post-queue_add()\ndereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also\ncovers the existing sock_net(nsk) access in that path.\n\nThe reqsk_timer_handler() path does not need the same changes for two\nreasons: half-open requests become readable only after the final ACK,\nwhere tcp_child_process() already wakes the listener; and once nreq is\nvisible via inet_ehash_insert(), the success path no longer touches\nnsk directly.","publishedAt":"2026-05-27T12:56:17.249Z","updatedAt":"2026-10-19T19:26:41.435Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"7aa7933a5607b1e5b56f322d17265c1d0ea02c51","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"14e9bb6eba8f59dcc637702e4744ae5e30660d76","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"bebd058ef40c67a81fe6d9ee8beaa4ede90e0704","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"83bb57635d7cbafde32f865b577ecfd969f02337","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"12625b4da84caf4d84a04988710a7b9bcf702b18","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"3864c6ba1e041bc75342353a70fa2a2c6f909923","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/inet_connection_sock.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.86","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.27","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.4","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/inet_connection_sock.c"]}],"references":["https://git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51","https://git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76","https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b","https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704","https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337","https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18","https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":["CWE-408"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/46xxx/CVE-2026-46015.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46015","state":"PUBLISHED","datePublished":"2026-05-27T12:56:17.249Z","dateUpdated":"2026-10-19T19:26:41.435Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-13T15:03:33.092Z"},"containers":{"cna":{"title":"tcp: call sk_data_ready() after listener migration","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: call sk_data_ready() after listener migration\n\nWhen inet_csk_listen_stop() migrates an established child socket from\na closing listener to another socket in the same SO_REUSEPORT group,\nthe target listener gets a new accept-queue entry via\ninet_csk_reqsk_queue_add(), but that path never notifies the target\nlistener's waiters. A nonblocking accept() still works because it\nchecks the queue directly, but poll()/epoll_wait() waiters and\nblocking accept() callers can also remain asleep indefinitely.\n\nCall READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration\nin inet_csk_listen_stop().\n\nHowever, after inet_csk_reqsk_queue_add() succeeds, the ref acquired\nin reuseport_migrate_sock() is effectively transferred to\nnreq->rsk_listener. Another CPU can then dequeue nreq via accept()\nor listener shutdown, hit reqsk_put(), and drop that listener ref.\nSince listeners are SOCK_RCU_FREE, wrap the post-queue_add()\ndereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also\ncovers the existing sock_net(nsk) access in that path.\n\nThe reqsk_timer_handler() path does not need the same changes for two\nreasons: half-open requests become readable only after the final ACK,\nwhere tcp_child_process() already wakes the listener; and once nreq is\nvisible via inet_ehash_insert(), the success path no longer touches\nnsk directly."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"7aa7933a5607b1e5b56f322d17265c1d0ea02c51","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"14e9bb6eba8f59dcc637702e4744ae5e30660d76","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"bebd058ef40c67a81fe6d9ee8beaa4ede90e0704","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"83bb57635d7cbafde32f865b577ecfd969f02337","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"12625b4da84caf4d84a04988710a7b9bcf702b18","versionType":"git"},{"version":"54b92e84193749c9968aff2dd46e3b0f42643e18","status":"affected","lessThan":"3864c6ba1e041bc75342353a70fa2a2c6f909923","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/inet_connection_sock.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.86","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.27","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.4","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/inet_connection_sock.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51"},{"url":"https://git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76"},{"url":"https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b"},{"url":"https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704"},{"url":"https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337"},{"url":"https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18"},{"url":"https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local socket lifecycle operations — creating an SO_REUSEPORT group, enabling migration, and closing the source listener while accepting/closing the target. A remote peer cannot set up the migration group or drive the race, so the vector is Local.\nAC:L - The attacker controls both sides of the race (the closing listener via inet_csk_listen_stop and the concurrent accept/close that drops the listener's last ref), and the missed-wakeup half is deterministic; per guidance an attacker-created race is Low.\nPR:L - Migration must be enabled, requiring CAP_NET_ADMIN to set the per-netns net.ipv4.tcp_migrate_req sysctl (or a SK_REUSEPORT/migrate BPF prog), all of which an unprivileged user obtains in a user namespace via unshare -Urn.\nUI:N - Triggering depends only on the attacker's own socket operations; no action by any other user is required.\nS:U - The use-after-free and its impact are confined to the kernel's own memory/security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of a SOCK_RCU_FREE listener socket lets reallocated/freed memory be read (e.g., via sock_net(nsk)), enabling kernel information disclosure.\nI:H - The freed socket is dereferenced for sock_net(nsk) in __NET_INC_STATS (a pointer-controlled increment) and sk_data_ready(nsk) (a function-pointer call), giving an attacker-influenced write/control-flow primitive after heap grooming.\nA:H - The use-after-free reliably crashes the kernel, and the always-present missed wakeup hangs a listener's accept/poll/epoll waiters indefinitely."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:29:10.115Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.12.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.18.27"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.0.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:19:56.221Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-46015","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:18:52.666086Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-408","lang":"en","type":"CWE","description":"CWE-408 Incorrect Behavior Order: Early Amplification"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:26:41.435Z"}}]}}}