CVE-2026-46015 tcp: call sk_data_ready() after listener migration
A missing notification in Linux kernel TCP listener migration causes blocking accept() and poll() waiters to hang indefinitely, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46015?
CVE-2026-46015 is a high-severity denial of service vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tcp: call sk_data_ready() after listener migration
When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener gets a new accept-queue entry via inet_csk_reqsk_queue_add(), but that path never notifies the target listener's waiters. A nonblocking accept() still works because it checks the queue directly, but poll()/epoll_wait() waiters and blocking accept() callers can also remain asleep indefinitely.
Call READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration in inet_csk_listen_stop().
However, after inet_csk_reqsk_queue_add() succeeds, the ref acquired in reuseport_migrate_sock() is effectively transferred to nreq->rsk_listener. Another CPU can then dequeue nreq via accept() or listener shutdown, hit reqsk_put(), and drop that listener ref. Since listeners are SOCK_RCU_FREE, wrap the post-queue_add() dereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also covers the existing sock_net(nsk) access in that path.
The reqsk_timer_handler() path does not need the same changes for two reasons: half-open requests become readable only after the final ACK, where tcp_child_process() already wakes the listener; and once nreq is visible via inet_ehash_insert(), the success path no longer touches nsk directly.
Weakness: CWE-408
Which versions are affected by CVE-2026-46015?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46015?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46015 being exploited?
There is no known exploitation of CVE-2026-46015 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88551, BELL-CVE-2026-46015, DEBIAN-CVE-2026-46015, GHSA-xg26-4rww-5g68, ROOT-OS-DEBIAN-12-CVE-2026-46015, ROOT-OS-UBUNTU-2204-CVE-2026-46015 and 2 more.