Executive brief
A memory leak vulnerability exists in the Linux kernel's stream parser, a component used for processing network messages. When certain network operations time out or are aborted, the system fails to release memory associated with partially received messages. An attacker could repeatedly trigger these timeouts to consume system memory, potentially leading to a denial-of-service condition where the server becomes unresponsive.
Technical details
A memory leak exists in the Linux kernel's net/strparser/strparser.c component. When the stream parser is aborted (e.g., due to a message assembly timeout), the strp_abort_strp() function fails to release the reference to the partially assembled socket buffer (skb) stored in strp->skb_head. An attacker can remotely trigger this condition repeatedly to exhaust kernel memory. The fix involves explicitly calling kfree_skb() on strp->skb_head and resetting the parser state during the abort path. Patches have been backported to multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and 6.6.y.
Affected products
- Linux Linux kernel All versions including and prior to 6.x series (fixed in various stable branches)
Timeline
- 2026-04-11: other: Vulnerability fix authored
- 2026-05-27: disclosed: CVE published and patches integrated into stable trees
References
- https://git.kernel.org/stable/c/19ca9475f18f991735f98a22e735c43e95e6298d
- https://git.kernel.org/stable/c/5327dad2ffe9c1b49881dd6d51ff3c6893847568
- https://git.kernel.org/stable/c/56082f442023db9be1a5a29d4ee361de4017c0b7
- https://git.kernel.org/stable/c/e9ae00490d474757c0f9c65073de83e6bb1e5a00
- https://git.kernel.org/stable/c/fe72340daaf1af588be88056faf98965f39e6032