Vulnerability-Lookup

CVE-2026-46015 (GCVE-0-2026-46015)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:56 – Updated: 2026-09-08 08:49

Title

tcp: call sk_data_ready() after listener migration

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener gets a new accept-queue entry via inet_csk_reqsk_queue_add(), but that path never notifies the target listener's waiters. A nonblocking accept() still works because it checks the queue directly, but poll()/epoll_wait() waiters and blocking accept() callers can also remain asleep indefinitely. Call READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration in inet_csk_listen_stop(). However, after inet_csk_reqsk_queue_add() succeeds, the ref acquired in reuseport_migrate_sock() is effectively transferred to nreq->rsk_listener. Another CPU can then dequeue nreq via accept() or listener shutdown, hit reqsk_put(), and drop that listener ref. Since listeners are SOCK_RCU_FREE, wrap the post-queue_add() dereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also covers the existing sock_net(nsk) access in that path. The reqsk_timer_handler() path does not need the same changes for two reasons: half-open requests become readable only after the final ACK, where tcp_child_process() already wakes the listener; and once nreq is visible via inet_ehash_insert(), the success path no longer touches nsk directly.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7aa7933a5607b1e5b…
https://git.kernel.org/stable/c/14e9bb6eba8f59dcc…
https://git.kernel.org/stable/c/ab5fdcd535645f6db…
https://git.kernel.org/stable/c/bebd058ef40c67a81…
https://git.kernel.org/stable/c/83bb57635d7cbafde…
https://git.kernel.org/stable/c/12625b4da84caf4d8…
https://git.kernel.org/stable/c/3864c6ba1e041bc75…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 7aa7933a5607b1e5b56f322d17265c1d0ea02c51 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 14e9bb6eba8f59dcc637702e4744ae5e30660d76 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < bebd058ef40c67a81fe6d9ee8beaa4ede90e0704 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 83bb57635d7cbafde32f865b577ecfd969f02337 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 12625b4da84caf4d84a04988710a7b9bcf702b18 (git) Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 3864c6ba1e041bc75342353a70fa2a2c6f909923 (git)	guessed
Linux	Linux	Affected: 5.14 Unaffected: 0 , < 5.14 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)	guessed
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)	guessed
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)	guessed
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:49:01.249Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7aa7933a5607b1e5b56f322d17265c1d0ea02c51",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "14e9bb6eba8f59dcc637702e4744ae5e30660d76",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "bebd058ef40c67a81fe6d9ee8beaa4ede90e0704",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "83bb57635d7cbafde32f865b577ecfd969f02337",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "12625b4da84caf4d84a04988710a7b9bcf702b18",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "3864c6ba1e041bc75342353a70fa2a2c6f909923",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: call sk_data_ready() after listener migration\n\nWhen inet_csk_listen_stop() migrates an established child socket from\na closing listener to another socket in the same SO_REUSEPORT group,\nthe target listener gets a new accept-queue entry via\ninet_csk_reqsk_queue_add(), but that path never notifies the target\nlistener\u0027s waiters. A nonblocking accept() still works because it\nchecks the queue directly, but poll()/epoll_wait() waiters and\nblocking accept() callers can also remain asleep indefinitely.\n\nCall READ_ONCE(nsk-\u003esk_data_ready)(nsk) after a successful migration\nin inet_csk_listen_stop().\n\nHowever, after inet_csk_reqsk_queue_add() succeeds, the ref acquired\nin reuseport_migrate_sock() is effectively transferred to\nnreq-\u003ersk_listener. Another CPU can then dequeue nreq via accept()\nor listener shutdown, hit reqsk_put(), and drop that listener ref.\nSince listeners are SOCK_RCU_FREE, wrap the post-queue_add()\ndereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also\ncovers the existing sock_net(nsk) access in that path.\n\nThe reqsk_timer_handler() path does not need the same changes for two\nreasons: half-open requests become readable only after the final ACK,\nwhere tcp_child_process() already wakes the listener; and once nreq is\nvisible via inet_ehash_insert(), the success path no longer touches\nnsk directly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local socket lifecycle operations \u2014 creating an SO_REUSEPORT group, enabling migration, and closing the source listener while accepting/closing the target. A remote peer cannot set up the migration group or drive the race, so the vector is Local.\nAC:L - The attacker controls both sides of the race (the closing listener via inet_csk_listen_stop and the concurrent accept/close that drops the listener\u0027s last ref), and the missed-wakeup half is deterministic; per guidance an attacker-created race is Low.\nPR:L - Migration must be enabled, requiring CAP_NET_ADMIN to set the per-netns net.ipv4.tcp_migrate_req sysctl (or a SK_REUSEPORT/migrate BPF prog), all of which an unprivileged user obtains in a user namespace via unshare -Urn.\nUI:N - Triggering depends only on the attacker\u0027s own socket operations; no action by any other user is required.\nS:U - The use-after-free and its impact are confined to the kernel\u0027s own memory/security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of a SOCK_RCU_FREE listener socket lets reallocated/freed memory be read (e.g., via sock_net(nsk)), enabling kernel information disclosure.\nI:H - The freed socket is dereferenced for sock_net(nsk) in __NET_INC_STATS (a pointer-controlled increment) and sk_data_ready(nsk) (a function-pointer call), giving an attacker-influenced write/control-flow primitive after heap grooming.\nA:H - The use-after-free reliably crashes the kernel, and the always-present missed wakeup hangs a listener\u0027s accept/poll/epoll waiters indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:10.115Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704"
        },
        {
          "url": "https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337"
        },
        {
          "url": "https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18"
        },
        {
          "url": "https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923"
        }
      ],
      "title": "tcp: call sk_data_ready() after listener migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46015",
    "datePublished": "2026-05-27T12:56:17.249Z",
    "dateReserved": "2026-05-13T15:03:33.092Z",
    "dateUpdated": "2026-09-08T08:49:01.249Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46015",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.02931"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:45:51.000Z",
      "cve": "CVE-2026-46015",
      "id": "msrc_CVE-2026-46015",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tcp: call sk_data_ready() after listener migration",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46015.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46015\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:19.840\",\"lastModified\":\"2026-09-08T09:18:06.277\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: call sk_data_ready() after listener migration\\n\\nWhen inet_csk_listen_stop() migrates an established child socket from\\na closing listener to another socket in the same SO_REUSEPORT group,\\nthe target listener gets a new accept-queue entry via\\ninet_csk_reqsk_queue_add(), but that path never notifies the target\\nlistener\u0027s waiters. A nonblocking accept() still works because it\\nchecks the queue directly, but poll()/epoll_wait() waiters and\\nblocking accept() callers can also remain asleep indefinitely.\\n\\nCall READ_ONCE(nsk-\u003esk_data_ready)(nsk) after a successful migration\\nin inet_csk_listen_stop().\\n\\nHowever, after inet_csk_reqsk_queue_add() succeeds, the ref acquired\\nin reuseport_migrate_sock() is effectively transferred to\\nnreq-\u003ersk_listener. Another CPU can then dequeue nreq via accept()\\nor listener shutdown, hit reqsk_put(), and drop that listener ref.\\nSince listeners are SOCK_RCU_FREE, wrap the post-queue_add()\\ndereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also\\ncovers the existing sock_net(nsk) access in that path.\\n\\nThe reqsk_timer_handler() path does not need the same changes for two\\nreasons: half-open requests become readable only after the final ACK,\\nwhere tcp_child_process() already wakes the listener; and once nreq is\\nvisible via inet_ehash_insert(), the success path no longer touches\\nnsk directly.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/inet_connection_sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"7aa7933a5607b1e5b56f322d17265c1d0ea02c51\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"14e9bb6eba8f59dcc637702e4744ae5e30660d76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"bebd058ef40c67a81fe6d9ee8beaa4ede90e0704\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"83bb57635d7cbafde32f865b577ecfd969f02337\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"12625b4da84caf4d84a04988710a7b9bcf702b18\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"3864c6ba1e041bc75342353a70fa2a2c6f909923\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/inet_connection_sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.86\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.27\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.4\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.209\",\"matchCriteriaId\":\"5DBAE898-A62B-4CA9-AD9A-DFE3A3675854\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"A1A92866-F406-43B5-B2D1-CFC274753E9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.86\",\"matchCriteriaId\":\"55DA1C62-9991-451E-B8A8-E0004E00F789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.27\",\"matchCriteriaId\":\"A10AC84F-C058-47D5-85B4-E6E51A613B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-10T03:35:02+00:00",
      "cve": "CVE-2026-46015",
      "id": "CVE-2026-46015",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: call sk_data_ready() after listener migration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46015.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:05:10Z",
      "cve": "CVE-2026-46015",
      "id": "CVE-2026-46015",
      "initial_release_date": "2026-05-28T03:54:21Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "557",
      "product_status:known_not_affected": "175",
      "product_status:recommended": "337",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46015",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46015.json",
      "version": "17"
    }
  }
}

rlsa-2026:66180

Vulnerability from osv_rocky

Published

2026-09-11 12:05

Modified

2026-09-16 12:13

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

Bug Fix(es) and Enhancement(s):

KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:66180	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2467065	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468102	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2479812	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2481936	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482566	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2484456	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486999	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492811	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492841	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2501252	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502394	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2510892	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2511932	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516731	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2517046	REPORT
	https://access.redhat.com/errata/RHSA-2026:66180	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:5.14.0-687.46.1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:66180"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)\n\n* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n\n* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n\n* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)\n\n* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)\n\n* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n\n* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n\n* kernel: Revert \"net/smc: Introduce TCP ULP support\" (CVE-2026-46330)\n\n* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)\n\n* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n\n* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n\n* kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)\n\n* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)\n\n* kernel: rhashtable: clear stale iter-\u003ep on table restart (CVE-2026-64563)\n\n* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)\n\n* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)\n\n* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)\n\nBug Fix(es) and Enhancement(s):\n\n* KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:66180",
  "modified": "2026-09-16T12:13:56.365851Z",
  "published": "2026-09-11T12:05:26.835797Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:66180"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481936"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482566"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486999"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492811"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492841"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501252"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502394"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510892"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511932"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516731"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517046"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:66180"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-43133",
    "CVE-2026-43339",
    "CVE-2026-43493",
    "CVE-2026-46015",
    "CVE-2026-46149",
    "CVE-2026-46266",
    "CVE-2026-46306",
    "CVE-2026-46330",
    "CVE-2026-53002",
    "CVE-2026-53223",
    "CVE-2026-53275",
    "CVE-2026-53366",
    "CVE-2026-64034",
    "CVE-2026-64563",
    "CVE-2026-64597",
    "CVE-2026-72129",
    "CVE-2026-74480"
  ]
}

SSA-019113

Vulnerability from csaf_siemens - Published: 2026-07-14 00:00 - Updated: 2026-09-08 00:00

Summary

SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6

Scope

431 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Known affected: 5 products

Open the full advisory

SUSE-SU-2026:23066-1

Vulnerability from csaf_suse - Published: 2026-08-11 20:56 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:23068-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:26 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 28 products

Open the full advisory

SUSE-SU-2026:23193-1

Vulnerability from csaf_suse - Published: 2026-08-18 18:56 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

648 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:23194-1

Vulnerability from csaf_suse - Published: 2026-08-18 19:48 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

647 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 14 products

Open the full advisory

SUSE-SU-2026:23221-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:26 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 114 products

Open the full advisory

SUSE-SU-2026:23231-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:26 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 114 products

Open the full advisory

SUSE-SU-2026:23237-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:34 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 9 products

Open the full advisory

SUSE-SU-2026:23241-1

Vulnerability from csaf_suse - Published: 2026-08-18 20:43 - Updated: 2026-09-16 09:03

Summary

Security update for the Linux Kernel

Severity

Important

Scope

648 vulnerabilities in this advisory, including CVE-2026-46015.

CVE-2026-46015

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-46015 (GCVE-0-2026-46015)

Vulnerability from osv_rocky

Tags

Sightings

Nomenclature

Related by attack behaviour