CVE-2026-46102 Overview
CVE-2026-46102 is a memory leak vulnerability in the Linux kernel's stream parser (strparser) subsystem. The flaw resides in strp_abort_strp(), which fails to release a partially assembled message stored in strp->skb_head when the parser is aborted. Conditions such as a message assembly timeout trigger the abort path, leaving the socket buffer (skb) referenced but never freed. An attacker able to repeatedly trigger the abort condition can exhaust kernel memory and degrade system availability.
Critical Impact
Repeated triggering of the strparser abort path leaks kernel memory through orphaned skb_head references, enabling a local denial-of-service condition through memory exhaustion.
Affected Products
- Linux kernel — net/strparser subsystem
- Kernel components and protocols that build on stream parser (such as Kernel TLS and AF_KCM)
- Stable kernel branches receiving the referenced backports
Discovery Timeline
- 2026-05-27 - CVE-2026-46102 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46102
Vulnerability Analysis
The Linux kernel stream parser assembles complete application-layer messages from incoming TCP byte streams. During assembly, the parser stores in-progress data in strp->skb_head. When the parser is aborted, for example after the assembly timer expires, control transfers to strp_abort_strp(). This function did not release the buffered skb_head, so the partially assembled message remained allocated for the lifetime of the parser instance.
The leak is reachable by any local attacker who can drive the parser into the abort state. Each abort cycle leaks one in-flight message buffer. Sustained looping inflates kernel slab usage and can lead to out-of-memory conditions on the host.
Root Cause
The root cause is missing cleanup logic in the abort path. strp_abort_strp() invalidated the parser state without calling kfree_skb() on strp->skb_head or resetting the pointer. The fix frees strp->skb_head and resets parser state inside the abort handler. strp_stop() is intentionally left unchanged so final teardown still occurs in strp_done() after the work queue and timer are synchronized.
Attack Vector
The vulnerability is reachable through socket interfaces that attach a stream parser, including Kernel TLS and AF_KCM. An attacker controlling a producer that intentionally stalls message assembly, or that crafts malformed framing, can force repeated parser aborts. Each abort retains a partial skb, and repetition exhausts kernel memory. Refer to the upstream commits (19ca9475f18f, 5327dad2ffe9, 56082f442023, e9ae00490d47, fe72340daaf1) for the exact code change.
Detection Methods for CVE-2026-46102
Indicators of Compromise
- Steady growth in kernel slab allocations associated with skbuff_head_cache without a matching workload increase.
- Repeated stream parser timeout events in kernel logs referencing strparser or KCM/KTLS sockets.
- Processes holding long-lived sockets that observe abnormal numbers of message assembly aborts.
Detection Strategies
- Monitor /proc/slabinfo for sustained growth in skbuff_head_cache and related skb slabs on hosts running KTLS or AF_KCM workloads.
- Audit dmesg and journal logs for repeated strparser abort or timeout messages tied to a single process.
- Use eBPF tracing on strp_abort_strp to count abort frequency per socket and flag outliers.
Monitoring Recommendations
- Baseline kernel memory consumption and alert on sustained upward drift outside normal workload patterns.
- Track per-process socket counts and aborted parser sessions to surface abusive clients.
- Correlate KTLS or KCM error counters with overall system memory pressure indicators such as MemAvailable decline.
How to Mitigate CVE-2026-46102
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits and reboot affected hosts.
- Inventory systems that load kcm or use Kernel TLS, since these consumers of strparser are the primary exposure points.
- Restrict untrusted local access to sockets that attach a stream parser until patched kernels are deployed.
Patch Information
The fix frees strp->skb_head and resets the parser state inside strp_abort_strp() while leaving strp_stop() unchanged so strp_done() performs final cleanup after work and timer synchronization. Patched builds are available through the stable kernel commits 19ca9475f18f, 5327dad2ffe9, 56082f442023, e9ae00490d47, and fe72340daaf1. Consult your distribution vendor for backported packages.
Workarounds
- Where feasible, unload or disable the kcm kernel module if it is not required for production workloads.
- Apply memory cgroup limits to workloads that hold stream parser sockets to contain blast radius until patching completes.
- Rate-limit or terminate processes that generate excessive parser abort events identified through eBPF or audit telemetry.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
