CVE-2026-46137
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential data-race This mptcp_pm_add_timer() helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bh_lock_sock(). If the socket is in use, retry again soon after, similar to what is done with the keepalive timer.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Undergoing Analysis
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-05-28 10:16:29.263000
Last modified
2026-10-19 20:18:34.383000
View original CVE JSON
{
"id": "CVE-2026-46137",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-05-28T10:16:29.263",
"lastModified": "2026-10-19T20:18:34.383",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: ADD_ADDR rtx: fix potential data-race\n\nThis mptcp_pm_add_timer() helper is executed as a timer callback in\nsoftirq context. To avoid any data races, the socket lock needs to be\nheld with bh_lock_sock().\n\nIf the socket is in use, retry again soon after, similar to what is done\nwith the keepalive timer."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/mptcp/pm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "d9b272a85fe6b8f993e37915311e4038c814a533",
"versionType": "git",
"status": "affected"
},
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "23079e0b7742ec114d3507c3e3aad01b7b69e4af",
"versionType": "git",
"status": "affected"
},
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "b35605e1f1e877038c8c9d499babbc891cdd234f",
"versionType": "git",
"status": "affected"
},
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "013dcdc1961543b9a3433466bc8c79a2f4ca75b5",
"versionType": "git",
"status": "affected"
},
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "6e4710d7d8782cb61af29a7e7111ddfc38b9e1a3",
"versionType": "git",
"status": "affected"
},
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "2ad56e434199ca24a812bb353667aa1c3860f513",
"versionType": "git",
"status": "affected"
},
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "cc3c0399361efaaf7ae64262eb3f70829b1189c6",
"versionType": "git",
"status": "affected"
},
{
"version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
"lessThan": "5cd6e0ad79d2615264f63929f8b457ad97ae550d",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/mptcp/pm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.10",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.10",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.259",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.210",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.176",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.141",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.91",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.30",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0.7",
"lessThanOrEqual": "7.0.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:20:17.146601Z",
"id": "CVE-2026-46137",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10",
"versionEndExcluding": "5.10.259",
"matchCriteriaId": "08AA0DD6-B427-47BB-BBC6-8C706816E0BE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.210",
"matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.176",
"matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.141",
"matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.91",
"matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.30",
"matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.0.7",
"matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/013dcdc1961543b9a3433466bc8c79a2f4ca75b5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/23079e0b7742ec114d3507c3e3aad01b7b69e4af",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2ad56e434199ca24a812bb353667aa1c3860f513",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5cd6e0ad79d2615264f63929f8b457ad97ae550d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6e4710d7d8782cb61af29a7e7111ddfc38b9e1a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b35605e1f1e877038c8c9d499babbc891cdd234f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/cc3c0399361efaaf7ae64262eb3f70829b1189c6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d9b272a85fe6b8f993e37915311e4038c814a533",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}