CVE-2026-46170: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46170 Overview

CVE-2026-46170 is a Linux kernel vulnerability in the Multipath TCP (MPTCP) Path Manager (PM) subsystem. The flaw resides in the ADD_ADDR retransmission handler, where incorrect reference counting on the socket structure can lead to a use-after-free or deadlock condition. When an ADD_ADDR message is retransmitted, the kernel holds a socket reference via sk_reset_timer() and releases it at the end of the handler. If that release represents the final reference, the kernel fails to free the socket correctly and may invoke sk_stop_timer_sync() on the running timer itself, causing indefinite waits.

Critical Impact
A flawed reference release path in MPTCP path management can trigger socket use-after-free or kernel hangs during ADD_ADDR retransmission.

Affected Products

Linux kernel versions implementing MPTCP path manager ADD_ADDR retransmission logic
Linux distributions shipping affected upstream kernel commits
Systems with MPTCP enabled in production networking stacks

Discovery Timeline

2026-05-28 - CVE-2026-46170 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46170

Vulnerability Analysis

The vulnerability exists in the MPTCP path manager logic that handles retransmission of ADD_ADDR control messages. MPTCP uses ADD_ADDR to advertise additional endpoint addresses available for subflow creation. To handle reliable delivery, the kernel arms a retransmission timer via sk_reset_timer(), which takes an extra reference on the socket.

At the end of the handler, the original code releases this reference using __sock_put(). This decrements the reference count without considering whether it was the final reference. When the handler holds the last reference, __sock_put() skips the freeing path and leaves the socket in an inconsistent state.

Switching to sock_put() alone is insufficient. If the call frees the socket, sk_free() is invoked, which calls sk_stop_timer_sync() on the same timer currently executing. The synchronous stop waits for the timer callback to finish, deadlocking against itself.

Root Cause

The root cause combines two defects: incorrect use of __sock_put() instead of sock_put() when releasing the timer-held reference, and absence of logic to mark the timer as complete before the release path runs. Together, these produce either a leaked socket or a self-referential sk_stop_timer_sync() wait. This class of issue maps to use-after-free and synchronization defects in kernel timer handling.

Attack Vector

Exploitation requires conditions that cause MPTCP ADD_ADDR retransmission to coincide with the final socket reference being released. A remote peer participating in an MPTCP session can influence retransmission behavior through manipulation of acknowledgments and connection lifecycle events. The practical impact is local kernel instability, including hung tasks and potential memory corruption on affected hosts using MPTCP.

The upstream fix is described in the official patch commits. See the Kernel Git Commit b7b9a461569734d33d3259d58d2507adfac107ed and the related stable backports for the exact code changes.

Detection Methods for CVE-2026-46170

Indicators of Compromise

Kernel hung_task warnings referencing sk_stop_timer_sync in MPTCP code paths
WARN_ON or BUG messages originating from net/mptcp/pm.c during ADD_ADDR retransmission
Unexpected kernel panics or task stalls on hosts handling long-lived MPTCP connections

Detection Strategies

Audit running kernel versions against the upstream MPTCP fix commits to identify unpatched hosts
Correlate kernel log entries showing MPTCP timer or sock_put anomalies with active MPTCP workloads
Monitor for repeated ADD_ADDR retransmissions in MPTCP-enabled flows, which expand the exploitation window

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log platform for kernel crash and hang detection
Track host uptime and unexpected reboots on systems with MPTCP enabled (net.mptcp.enabled=1)
Alert on tasks blocked in sk_stop_timer_sync or MPTCP path manager functions for extended periods

How to Mitigate CVE-2026-46170

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution containing the upstream MPTCP path manager fix
Inventory all hosts with MPTCP enabled and prioritize patching for systems exposed to untrusted networks
Validate kernel build pipelines include the three referenced commits for affected long-term support branches

Patch Information

The fix replaces __sock_put() with sock_put() and adds explicit logic to mark the retransmission timer as complete before the socket reference is released, preventing sk_stop_timer_sync() from waiting on its own callback. Reference the upstream commits 8143a224785c, b74ad2019865, and b7b9a4615697 for the canonical resolution.

Workarounds

Disable MPTCP on hosts where it is not required by setting net.mptcp.enabled=0 via sysctl
Restrict MPTCP-capable services to trusted network segments until patches are deployed
Limit the use of ADD_ADDR advertisements by configuring path manager policies to reduce retransmission frequency

bash

# Configuration example: disable MPTCP until kernel is patched
sudo sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

# Verify current kernel and MPTCP status
uname -r
sysctl net.mptcp.enabled