CVE-2026-46137: critical vulnerability (CVSS 9.8)
CVE-2026-46137 is a critical Linux kernel vulnerability (CVSS 9.8) affecting the Multipath TCP (MPTCP) protocol. A data race issue in the ADD_ADDR timer callback was resolved by enforcing socket locks with bh_lock_sock().
This flaw could allow attackers to exploit race conditions in MPTCP, leading to potential privilege escalation or denial-of-service. Ensure kernel patches are applied immediately to mitigate risks.
The vulnerability is rooted in the Multipath TCP (MPTCP) protocol within the Linux kernel, specifically in the ADD_ADDR timer callback function. A lack of proper socket locking led to potential data races in softirq context.
To address the issue, developers implemented bh_lock_sock() to ensure socket locks are held during execution. This prevents race conditions and retries operations when the socket is in use, similar to the keepalive timer logic.
Given the high CVSS score of 9.8, this vulnerability poses significant risks. Administrators should prioritize updating their Linux kernels to the latest patched version to prevent exploitation.