CVE-2026-46102

net: strparser: fix skb_head leak in strp_abort_strp()

State: Published
Severity: 7.5 High
Published: May 27, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: strparser: fix skb_head leak in strp_abort_strp()

When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skb_head.

That skb is not released in strp_abort_strp(), which leaks the partially assembled message and can be triggered repeatedly to exhaust memory.

Fix this by freeing strp->skb_head and resetting the parser state in the abort path. Leave strp_stop() unchanged so final cleanup still happens in strp_done() after the work and timer have been synchronized.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3Affected 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before a470ed71c906cc8cbad0d74c9942216698911f8bAffected 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before c2e57695ec9ff9d42f23de70f3805199153d007bAffected 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before e9ae00490d474757c0f9c65073de83e6bb1e5a00Affected 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before 5327dad2ffe9c1b49881dd6d51ff3c6893847568Affected 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before 19ca9475f18f991735f98a22e735c43e95e6298dAffected 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before 56082f442023db9be1a5a29d4ee361de4017c0b7Affected 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before fe72340daaf1af588be88056faf98965f39e6032Affected
LinuxLinux	4.9Affected before 4.9Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.86 through 6.12.Not affected 6.18.27 through 6.18.Not affected 7.0.4 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3Affected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before a470ed71c906cc8cbad0d74c9942216698911f8bAffected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before c2e57695ec9ff9d42f23de70f3805199153d007bAffected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before e9ae00490d474757c0f9c65073de83e6bb1e5a00Affected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before 5327dad2ffe9c1b49881dd6d51ff3c6893847568Affected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before 19ca9475f18f991735f98a22e735c43e95e6298dAffected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before 56082f442023db9be1a5a29d4ee361de4017c0b7Affected
43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a to before fe72340daaf1af588be88056faf98965f39e6032Affected

LinuxLinux

4.9Affected
before 4.9Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.86 through 6.12.*Not affected
6.18.27 through 6.18.*Not affected
7.0.4 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.