{"id":"CVE-2026-46015","revision":"fb30ac763837431eb3894726e62b8dd2","records":[{"revision":"fb30ac763837431eb3894726e62b8dd2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-46015","aliases":[],"title":"tcp: call sk_data_ready() after listener migration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: call sk_data_ready() after listener migration\n\nWhen inet_csk_listen_stop() migrates an established child socket from\na closing listener to another socket in the same SO_REUSEPORT group,\nthe target listener gets a new accept-queue entry via\ninet_csk_reqsk_queue_add(), but that path never notifies the target\nlistener's waiters. A nonblocking accept() still works because it\nchecks the queue directly, but poll()/epoll_wait() waiters and\nblocking accept() callers can also remain asleep indefinitely.\n\nCall READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration\nin inet_csk_listen_stop().\n\nHowever, after inet_csk_reqsk_queue_add() succeeds, the ref acquired\nin reuseport_migrate_sock() is effectively transferred to\nnreq->rsk_listener. Another CPU can then dequeue nreq via accept()\nor listener shutdown, hit reqsk_put(), and drop that listener ref.\nSince listeners are SOCK_RCU_FREE, wrap the post-queue_add()\ndereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also\ncovers the existing sock_net(nsk) access in that path.\n\nThe reqsk_timer_handler() path does not need the same changes for two\nreasons: half-open requests become readable only after the final ACK,\nwhere tcp_child_process() already wakes the listener; and once nreq is\nvisible via inet_ehash_insert(), the success path no longer touches\nnsk directly.","state":0,"publishedAt":"2026-05-27T12:56:17.249+00:00","modifiedAt":"2026-10-19T19:26:41.435+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/inet_connection_sock.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"54b92e84193749c9968aff2dd46e3b0f42643e18\",\n                            \"lessThan\": \"7aa7933a5607b1e5b56f322d17265c1d0ea02c51\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54b92e84193749c9968aff2dd46e3b0f42643e18\",\n                            \"lessThan\": \"14e9bb6eba8f59dcc637702e4744ae5e30660d76\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54b92e84193749c9968aff2dd46e3b0f42643e18\",\n                            \"lessThan\": \"ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54b92e84193749c9968aff2dd46e3b0f42643e18\",\n                            \"lessThan\": \"bebd058ef40c67a81fe6d9ee8beaa4ede90e0704\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54b92e84193749c9968aff2dd46e3b0f42643e18\",\n                            \"lessThan\": \"83bb57635d7cbafde32f865b577ecfd969f02337\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54b92e84193749c9968aff2dd46e3b0f42643e18\",\n                            \"lessThan\": \"12625b4da84caf4d84a04988710a7b9bcf702b18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54b92e84193749c9968aff2dd46e3b0f42643e18\",\n                            \"lessThan\": \"3864c6ba1e041bc75342353a70fa2a2c6f909923\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/inet_connection_sock.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.209\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.140\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.86\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.27\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.4\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51","https://git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76","https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b","https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704","https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337","https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18","https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46015","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-46015","identifiers":["CVE-2026-46015"]},"retained":false,"historicalAffected":[]}],"coverage":[]}