PT-2026-44293 · Opensuse+1 · Opensuse Tumbleweed+1
CVE-2026-46170
·
Published
2026-05-28
·
Updated
2026-07-28
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1
Description
An issue exists in the Multipath TCP (mptcp) path manager during the retransmission of an
ADD ADDR message. When the sk (socket) is held in sk reset timer() and released at the end, it may not be freed if it was the last reference. Using sock put() instead of sock put() is insufficient because if it is the last reference, sock put() triggers sk free(), which calls sk stop timer sync() on the same timer. This creates a deadlock where the system waits indefinitely for the timer to finish. To prevent this, the timer must be marked as done at the end of the handler when it has not been rescheduled.Recommendations
Update openSUSE Tumbleweed to version kernel-devel-7.0.11-1.1.
At the moment, there is no information about a newer version that contains a fix for this vulnerability for the Linux kernel.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Opensuse Tumbleweed