Skip to main content

Linux Kernel CVE-2026-46015

| EUVDEUVD-2026-32396 HIGH
Incorrect Behavior Order: Early Amplification (CWE-408)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-xg26-4rww-5g68
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local unprivileged shell on Linux host
  2. Delivery
    Create SO_REUSEPORT listener group with sibling sockets
  3. Exploit
    Trigger listener shutdown while child sockets migrate
  4. Install
    Race accept()/reqsk_put() on second CPU
  5. C2
    Drop listener ref outside RCU window
  6. Execute
    Reclaim freed listener memory
  7. Impact
    Achieve kernel UAF for privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-408
Exploitation Conditions

Requires local code execution on the host (CVSS AV:L) with the ability to create TCP sockets and bind them with SO_REUSEPORT (PR:L - any unprivileged user that can open sockets, which is the default on Linux), and the running kernel must include the reuseport listener-migration code path introduced in 5.14 and not yet patched to 6.6.140/6.12.86/6.18.27/7.0.4/7.1-rc1. The attacker must establish a SO_REUSEPORT group with at least two listeners, drive a listener shutdown via inet_csk_listen_stop() while child sockets are being migrated, and race accept()/reqsk_put() on a sibling CPU to hit either the missed wake-up (hang) or the UAF window on the transferred listener reference. Limiting factors: no remote vector (AV:L), no user interaction, but the race window is narrow and requires precise multi-CPU timing on a kernel built with SO_REUSEPORT migration enabled.
Impact

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local access with low privileges and high CIA impact, consistent with a kernel-side UAF/race that could yield memory corruption. However, EPSS is 0.02% (5th percentile) and there is no KEV listing or public exploit, indicating no observed exploitation pressure. The vendor-supplied 'Information Disclosure' tag understates the issue: the primary symptom is a missed wake-up (hangs/availability) and the secondary risk is a UAF on a SOCK_RCU_FREE listener - exploitability of that UAF is plausible but requires winning a narrow race during listener shutdown across SO_REUSEPORT siblings, on kernels 5.14+ that actually use the reuseport migration path. Realistic priority is moderate: patch in line with normal stable-kernel cadence; not an emergency unless the host runs custom TCP services that rely on reuseport migration with attacker-controlled triggering of listener shutdown.
Exploit ScenarioDerived

A local attacker with the ability to create TCP listeners (CAP_NET_BIND for low ports is not even needed for high ports) opens two sockets in the same SO_REUSEPORT group, induces a listener shutdown while child sockets are being migrated, and races accept()/reqsk_put() against the migrating path to either hang waiters or trigger a use-after-free on the freed listener. With sufficient race-window control, the UAF on a SOCK_RCU_FREE listener could be steered toward kernel memory corruption and privilege escalation, consistent with the CVSS High CIA impact; no public POC is currently identified.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Race condition and missed wake-up in the Linux kernel TCP listener migration path (SO_REUSEPORT) allows local low-privileged attackers to cause hangs and potentially exploit a use-after-free on listener sockets. Affects kernels from 5.14 up to versions fixed in 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1. No public exploit identified at time of analysis, and EPSS is very low (0.02%).

RemediationAI

Vendor-released patches: upgrade to Linux 6.6.140, 6.12.86, 6.18.27, 7.0.4, or 7.1-rc1 (or newer in each series) using the upstream commits at https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704, https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18, https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923, https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337, and https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b. For distribution kernels, install the vendor-shipped kernel update that backports these commits and reboot. As an interim compensating control where patching is not yet possible, avoid SO_REUSEPORT-based listener migration in production services (do not bind multiple listeners with SO_REUSEPORT on the same port for graceful-restart workflows), and restrict who can run arbitrary network-service code on the host so that local low-privileged users cannot induce the race; both measures reduce risk but also remove the graceful-handoff capability that reuseport migration provides.

Affected VersionsENISA

Linux 54b92e84193749c9968aff2dd46e3b0f42643e18 <bebd058ef40c67a81fe6d9ee8beaa4ede90e0704
Linux patch: 6.6.140
Linux 54b92e84193749c9968aff2dd46e3b0f42643e18 <12625b4da84caf4d84a04988710a7b9bcf702b18
Linux patch: 7.0.4
Linux patch: 6.18.27
Linux 54b92e84193749c9968aff2dd46e3b0f42643e18 <3864c6ba1e041bc75342353a70fa2a2c6f909923
Linux 54b92e84193749c9968aff2dd46e3b0f42643e18 <83bb57635d7cbafde32f865b577ecfd969f02337
Linux 5.14
Linux patch: 6.12.86
Linux patch: 0
Linux patch: 7.1-rc1
Linux 54b92e84193749c9968aff2dd46e3b0f42643e18 <ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in net/ipv4/inet_connection_sock.c in the SO_REUSEPORT listener-migration logic. When inet_csk_listen_stop() shuts down a listener and migrates an established child socket to a sibling listener in the same reuseport group, inet_csk_reqsk_queue_add() places the child on the target's accept queue but never invokes sk_data_ready() on the target. As a result, blocking accept() callers and poll()/epoll_wait() waiters on the target listener never wake up. Additionally, the listener reference taken by reuseport_migrate_sock() is transferred to nreq->rsk_listener once queued, so another CPU racing through accept() or listener shutdown can call reqsk_put() and free the listener while the migrating path still dereferences it; because listener sockets are SOCK_RCU_FREE, only an RCU read-side critical section makes those post-queue dereferences safe. The fix adds the missing sk_data_ready() call and wraps post-queue_add nsk accesses (including sock_net(nsk)) in rcu_read_lock()/rcu_read_unlock().

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
7.8 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tcp: call sk_data_ready() after listener migration

When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener gets a new accept-queue entry via inet_csk_reqsk_queue_add(), but that path never notifies the target listener's waiters. A nonblocking accept() still works because it checks the queue directly, but poll()/epoll_wait() waiters and blocking accept() callers can also remain asleep indefinitely.

Call READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration in inet_csk_listen_stop().

However, after inet_csk_reqsk_queue_add() succeeds, the ref acquired in reuseport_migrate_sock() is effectively transferred to nreq->rsk_listener. Another CPU can then dequeue nreq via accept() or listener shutdown, hit reqsk_put(), and drop that listener ref. Since listeners are SOCK_RCU_FREE, wrap the post-queue_add() dereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also covers the existing sock_net(nsk) access in that path.

The reqsk_timer_handler() path does not need the same changes for two reasons: half-open requests become readable only after the final ACK, where tcp_child_process() already wakes the listener; and once nreq is visible via inet_ehash_insert(), the success path no longer touches nsk directly.

Executive ViewAI

Why It Matters

CVE-2026-46015 in the Linux kernel affects versions 5.14 through specific fixes in the 6.6, 6.12, 6.18, and 7.x branches, exposing systems to service hangs and memory corruption from local attackers. The risk primarily affects organizations running multi-tenant systems, shared computing environments, or infrastructure vulnerable to privilege escalation where local code execution is possible. Timely patching is essential to prevent service disruption and unauthorized access.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
2
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-408 – Incorrect Behavior Order: Early Amplification

View all
CVE-2022-2576 HIGH POC
7.5
CVE-2026-41405 HIGH
8.7
CVE-2026-11605 HIGH
7.5
CVE-2020-1657 HIGH
7.5
CVE-2026-41374 MEDIUM
6.9
CVE-2026-41331 MEDIUM
6.9
CVE-2026-104032 MEDIUM
5.5
CVE-2026-3592 MEDIUM
5.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-11 ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/366256 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18 REF https://git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76 REF https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923 REF https://git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51 REF https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337 REF https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b REF https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy