CVE-2026-46137 PUBLISHED

mptcp: pm: ADD_ADDR rtx: fix potential data-race

Assigner: Linux
Reserved: 13.05.2026 Published: 28.05.2026 Updated: 30.05.2026

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: ADD_ADDR rtx: fix potential data-race

This mptcp_pm_add_timer() helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bh_lock_sock().

If the socket is in use, retry again soon after, similar to what is done with the keepalive timer.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to 013dcdc1961543b9a3433466bc8c79a2f4ca75b5 (excl.)
  • affected from 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to 6e4710d7d8782cb61af29a7e7111ddfc38b9e1a3 (excl.)
  • affected from 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to 2ad56e434199ca24a812bb353667aa1c3860f513 (excl.)
  • affected from 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to cc3c0399361efaaf7ae64262eb3f70829b1189c6 (excl.)
  • affected from 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to 5cd6e0ad79d2615264f63929f8b457ad97ae550d (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.10 is affected
  • unaffected from 0 to 5.10 (excl.)
  • unaffected from 6.6.141 to 6.6.* (incl.)
  • unaffected from 6.12.91 to 6.12.* (incl.)
  • unaffected from 6.18.30 to 6.18.* (incl.)
  • unaffected from 7.0.7 to 7.0.* (incl.)
  • unaffected from 7.1-rc3 to * (incl.)

References