CVE-2026-46102
published 2026-05-27CVE-2026-46102: In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the stream parser is aborted…
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved:
net: strparser: fix skb_head leak in strp_abort_strp()
When the stream parser is aborted, for example after a message assembly timeout,
it can still hold a reference to a partially assembled message in
strp->skb_head.
That skb is not released in strp_abort_strp(), which leaks the partially
assembled message and can be triggered repeatedly to exhaust memory.
Fix this by freeing strp->skb_head and resetting the parser state in the
abort path. Leave strp_stop() unchanged so final cleanup still happens in
strp_done() after the work and timer have been synchronized.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3 | d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3 |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < a470ed71c906cc8cbad0d74c9942216698911f8b | a470ed71c906cc8cbad0d74c9942216698911f8b |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < c2e57695ec9ff9d42f23de70f3805199153d007b | c2e57695ec9ff9d42f23de70f3805199153d007b |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < e9ae00490d474757c0f9c65073de83e6bb1e5a00 | e9ae00490d474757c0f9c65073de83e6bb1e5a00 |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < 5327dad2ffe9c1b49881dd6d51ff3c6893847568 | 5327dad2ffe9c1b49881dd6d51ff3c6893847568 |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < 19ca9475f18f991735f98a22e735c43e95e6298d | 19ca9475f18f991735f98a22e735c43e95e6298d |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < 56082f442023db9be1a5a29d4ee361de4017c0b7 | 56082f442023db9be1a5a29d4ee361de4017c0b7 |
| linux | linux | >= 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a < fe72340daaf1af588be88056faf98965f39e6032 | fe72340daaf1af588be88056faf98965f39e6032 |
| linux | linux_kernel | — | — |