{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-46015",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-46015",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-05-27T12:56:17.249Z",
    "updatedAt": "2026-10-19T19:26:41.435Z",
    "importedAt": "2026-10-24T01:58:14.884Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "tcp: call sk_data_ready() after listener migration",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: call sk_data_ready() after listener migration\n\nWhen inet_csk_listen_stop() migrates an established child socket from\na closing listener to another socket in the same SO_REUSEPORT group,\nthe target listener gets a new accept-queue entry via\ninet_csk_reqsk_queue_add(), but that path never notifies the target\nlistener's waiters. A nonblocking accept() still works because it\nchecks the queue directly, but poll()/epoll_wait() waiters and\nblocking accept() callers can also remain asleep indefinitely.\n\nCall READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration\nin inet_csk_listen_stop().\n\nHowever, after inet_csk_reqsk_queue_add() succeeds, the ref acquired\nin reuseport_migrate_sock() is effectively transferred to\nnreq->rsk_listener. Another CPU can then dequeue nreq via accept()\nor listener shutdown, hit reqsk_put(), and drop that listener ref.\nSince listeners are SOCK_RCU_FREE, wrap the post-queue_add()\ndereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also\ncovers the existing sock_net(nsk) access in that path.\n\nThe reqsk_timer_handler() path does not need the same changes for two\nreasons: half-open requests become readable only after the final ACK,\nwhere tcp_child_process() already wakes the listener; and once nreq is\nvisible via inet_ehash_insert(), the success path no longer touches\nnsk directly.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7aa7933a5607b1e5b56f322d17265c1d0ea02c51"
            },
            {
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "status": "affected",
              "versionType": "git",
              "lessThan": "14e9bb6eba8f59dcc637702e4744ae5e30660d76"
            },
            {
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b"
            },
            {
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "status": "affected",
              "versionType": "git",
              "lessThan": "bebd058ef40c67a81fe6d9ee8beaa4ede90e0704"
            },
            {
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "status": "affected",
              "versionType": "git",
              "lessThan": "83bb57635d7cbafde32f865b577ecfd969f02337"
            },
            {
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "status": "affected",
              "versionType": "git",
              "lessThan": "12625b4da84caf4d84a04988710a7b9bcf702b18"
            },
            {
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3864c6ba1e041bc75342353a70fa2a2c6f909923"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.14",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.14"
            },
            {
              "version": "5.15.209",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.175",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.140",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.86",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.27",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.0.4",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "version": "7.1",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}