01 Record

CVE-2026-46158

mptcp: pm: ADD_ADDR rtx: always decrease sk refcount

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

mptcp: pm: ADD_ADDR rtx: always decrease sk refcount

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.12% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 2.1% of scored records. A rank, not a probability.
NVD base score: 5.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-09-14.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2026-05-28 09:36Z5 MO AGO
Last updated: 2026-09-14 11:58Z1 MO AGO
Reserved: 2026-05-13
Assigning CNA: Linux
Record state: PUBLISHED
Severity: Not rated by the issuing CNA
CNA CVSS vector: Not published by the issuing CNA
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 906597af9272537fa359f58d532cdfe2f9e7abb70b5b3836423e3d74bc68689a

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < f5555a6d7c472849fdf2b426e3d0a85103118793, 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < e9ba34301d2e90f63f97c76ad9eb98e5250fe961, 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < 81d8142148164176385c279c7c1e1d581867423d, 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < 9426265e157dd77ec237c795901ed4dea6d69b5c, 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < b41dd76f3b9735096c21d3e799a2b9fe36498d57, 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < acd3d3562315c99f3c0db16f0fcc5f0306638982, 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < 25e37407442b8766ec2cf52fb4e31b5c3d3aeeae, 00cfd77b9063dcdf3628a7087faba60de85a9cc8 to < 9634cb35af17019baec21ca648516ce376fa10e6, 5.10—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/f5555a6d7c472849fdf2b426e3d0a85103118793
git.kernel.orghttps://git.kernel.org/stable/c/e9ba34301d2e90f63f97c76ad9eb98e5250fe961
git.kernel.orghttps://git.kernel.org/stable/c/81d8142148164176385c279c7c1e1d581867423d
git.kernel.orghttps://git.kernel.org/stable/c/9426265e157dd77ec237c795901ed4dea6d69b5c
git.kernel.orghttps://git.kernel.org/stable/c/b41dd76f3b9735096c21d3e799a2b9fe36498d57
git.kernel.orghttps://git.kernel.org/stable/c/acd3d3562315c99f3c0db16f0fcc5f0306638982
git.kernel.orghttps://git.kernel.org/stable/c/25e37407442b8766ec2cf52fb4e31b5c3d3aeeae
git.kernel.orghttps://git.kernel.org/stable/c/9634cb35af17019baec21ca648516ce376fa10e6

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.94-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.0.7-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.