Executive brief
A vulnerability in the Linux kernel's networking component could cause network services to stop responding to new connections. This occurs when a server process is shutting down and tries to hand off its active connections to another process. If the handoff fails to notify the new process correctly, the system may stop accepting new traffic, leading to a service outage.
Technical details
A vulnerability exists in the Linux kernel's TCP stack within the inet_csk_listen_stop() function. When migrating an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the kernel fails to notify the target listener's waiters after adding a new entry to the accept queue. This results in poll(), epoll_wait(), and blocking accept() callers remaining asleep indefinitely, even though data is ready to be processed. The fix involves calling sk_data_ready() after a successful migration and ensuring proper RCU locking to prevent use-after-free scenarios during the notification.
Affected products
- Linux Linux kernel All versions prior to the fixed stable releases (6.1, 6.6, 6.8, 6.9)
Timeline
- 2026-04-22: patched: Initial patch submitted by Zhenzhong Wu
- 2026-05-27: advisory: CVE-2026-46015 published by NVD
References
- https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18
- https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923
- https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337
- https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b
- https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704