Improper resource shutdown or release in Linux kernel - CVE-2026-46170

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU133026

Improper resource shutdown or release in Linux kernel - CVE-2026-46170

Published: May 29, 2026


Vulnerability identifier: #VU133026
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46170
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission timer handling when processing ADD_ADDR retransmissions. A local user can trigger ADD_ADDR retransmissions to cause a system hang.

The issue occurs when the last socket reference is released from the timer handler, leading to an indefinite wait on the same timer.


Affected software

Linux kernel
Debian Linux
Ubuntu
linux (Ubuntu package)
linux-kvm (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-oracle (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-5.15 (Ubuntu package)
linux-lowlatency-hwe-5.15 (Ubuntu package)
linux-hwe-5.15 (Ubuntu package)
linux-fips (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-realtime (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-azure-fde-5.15 (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-ibm (Ubuntu package)
linux-intel-iotg-5.15 (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-raspi (Ubuntu package)
linux-lowlatency-hwe-6.8 (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-azure-6.8 (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-oracle-6.8 (Ubuntu package)
linux-nvidia-lowlatency (Ubuntu package)
linux-nvidia-6.8 (Ubuntu package)
linux-ibm-6.8 (Ubuntu package)
linux-xilinx (Ubuntu package)
linux-gcp-6.8 (Ubuntu package)
linux-raspi-realtime (Ubuntu package)
linux-realtime-6.8 (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-nvidia-7.0 (Ubuntu package)
linux (Debian package)

How to mitigate CVE-2026-46170

Install security update from vendor's repository.

linux (Ubuntu package) - addressed in versions 5.15.0-202.212, 6.8.0-139.139, 7.0.0-28.28
linux-kvm (Ubuntu package) - update to 5.15.0-1111.116
linux-aws (Ubuntu package) - addressed in versions 5.15.0-1119.126, 6.8.0-1064.67, 7.0.0-1009.9
linux-gcp (Ubuntu package) - addressed in versions 5.15.0-1120.130, 6.8.0-1067.75, 7.0.0-1008.8
linux-azure (Ubuntu package) - addressed in versions 5.15.0-1125.134, 6.8.0-1067.75, 7.0.0-1010.10
linux-oracle (Ubuntu package) - addressed in versions 5.15.0-1116.122, 6.8.0-1061.64, 7.0.0-1008.8
linux-lowlatency (Ubuntu package) - addressed in versions 5.15.0-197.207, 6.8.0-139.139.1
linux-gke (Ubuntu package) - addressed in versions 5.15.0-1115.121, 6.8.0-1062.70, 7.0.0-1003.4
linux-aws-5.15 (Ubuntu package) - update to 5.15.0-1119.126~20.04.1
linux-lowlatency-hwe-5.15 (Ubuntu package) - update to 5.15.0-197.207~20.04.1
linux-hwe-5.15 (Ubuntu package) - update to 5.15.0-202.212~20.04.1
linux-fips (Ubuntu package) - addressed in versions 5.15.0-202.212+fips1, 6.8.0-139.139+fips1
linux-azure-5.15 (Ubuntu package) - update to 5.15.0-1125.134~20.04.1
linux-intel-iotg (Ubuntu package) - update to 5.15.0-1114.120
linux-realtime (Ubuntu package) - addressed in versions 5.15.0-1118.127, 6.8.1-1059.60, 7.0.0-28.28.1
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra (Ubuntu package) - addressed in versions 5.15.0-1070.72, 6.8.0-1035.38
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1114.115, 6.8.0-1062.65, 7.0.0-1016.16
linux-azure-fde-5.15 (Ubuntu package) - update to 5.15.0-1124.133~20.04.1
linux-ibm-5.15 (Ubuntu package) - update to 5.15.0-1113.117~20.04.1
linux-gkeop (Ubuntu package) - addressed in versions 5.15.0-1102.110, 6.8.0-1049.53
linux-ibm (Ubuntu package) - addressed in versions 5.15.0-1113.117, 6.8.0-1064.65, 7.0.0-1010.10
linux-intel-iotg-5.15 (Ubuntu package) - update to 5.15.0-1114.120~20.04.1
linux-oracle-5.15 (Ubuntu package) - update to 5.15.0-1116.122~20.04.1
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1120.130~20.04.1
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux-azure-fde (Ubuntu package) - addressed in versions 5.15.0-1124.133, 6.8.0-1065.72, 7.0.0-1009.9
linux-intel-iot-realtime (Ubuntu package) - update to 5.15.0-1111.115
linux-gcp-fips (Ubuntu package) - addressed in versions 5.15.0-1120.130+fips1, 6.8.0-1067.75+fips1
linux-aws-fips (Ubuntu package) - addressed in versions 5.15.0-1119.126+fips1, 6.8.0-1064.67+fips1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0-1125.134+fips1, 6.8.0-1067.75+fips1
linux-raspi (Ubuntu package) - addressed in versions 6.8.0-1064.68, 7.0.0-1015.15
linux-lowlatency-hwe-6.8 (Ubuntu package) - update to 6.8.0-139.139.1~22.04.1
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1065.72~22.04.1
linux-azure-6.8 (Ubuntu package) - update to 6.8.0-1067.75~22.04.1
linux-aws-6.8 (Ubuntu package) - update to 6.8.0-1064.67~22.04.1
linux-oracle-6.8 (Ubuntu package) - update to 6.8.0-1061.64~22.04.1
linux-nvidia-lowlatency (Ubuntu package) - update to 6.8.0-1062.65.1
linux-nvidia-6.8 (Ubuntu package) - update to 6.8.0-1062.65~22.04.1
linux-ibm-6.8 (Ubuntu package) - update to 6.8.0-1066.67~22.04.1
linux-xilinx (Ubuntu package) - update to 6.8.0-1036.37
linux-gcp-6.8 (Ubuntu package) - update to 6.8.0-1067.75~22.04.1
linux-raspi-realtime (Ubuntu package) - update to 6.8.0-2053.55
linux-realtime-6.8 (Ubuntu package) - update to 6.8.1-1059.60~22.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1009.9
linux-nvidia-7.0 (Ubuntu package) - update to 7.0.0-1016.16~24.04.1
linux (Debian package) - update to 6.12.94-1

External References

Related Security Bulletins