Linux Kernel CVE-2026-46170

MPTCP (Multipath TCP, RFC 8684) extends TCP to allow a single connection to use multiple network paths simultaneously. The ADD_ADDR signal advertises additional IP addresses to the remote peer and is subject to kernel-managed retransmission via sk_reset_timer(). The Linux kernel socket reference counting mechanism distinguishes __sock_put() - which unconditionally decrements the refcount without acting on zero - from sock_put(), which checks for zero and calls sk_free() for final cleanup. The root cause is the use of __sock_put() in the ADD_ADDR retransmission timer handler, which means if the timer holds the final reference and is not rescheduled, the socket is never freed (memory leak). Attempting a naive fix by substituting sock_put() introduces a second-order deadlock: sk_free() calls sk_stop_timer_sync(), which attempts to synchronously wait for the very timer callback that called it, resulting in an indefinite hang. The correct fix requires marking the timer as inactive before potential sk_free() invocation. Affected CPE: cpe:2.3:o:linux:linux_kernel.