Executive brief
A vulnerability was identified in the Linux kernel's networking component that could lead to a resource leak. Specifically, when the system attempts to retransmit certain network address information, it may fail to properly release internal memory references. Over time, this could potentially lead to system instability or performance degradation as resources are exhausted.
Technical details
A reference count leak exists in the MPTCP (MultiPath TCP) Path Manager within the Linux kernel. When an ADD_ADDR message is retransmitted, the socket (sk) reference count is incremented via sk_reset_timer(). However, certain error paths in mptcp_pm_add_timer() returned directly without calling sock_put(), preventing the reference count from being decremented. This results in a kernel memory leak. The fix introduces a unified exit label to ensure __sock_put() is called in all execution paths. This issue was addressed in the stable kernel branches via commits 25e3740, 9634cb3, and acd3d35.
Affected products
- Linux Linux kernel Versions including MPTCP ADD_ADDR retransmission support
Timeline
- 2026-05-05: patched: Initial patch authored by Matthieu Baerts
- 2026-05-28: disclosed: CVE published to NVD dataset