CVE-2026-46102
Awaiting Analysis Awaiting Analysis - Queue
Memory Leak in Linux Kernel Stream Parser

Publication date: 2026-05-27

Last updated on: 2026-06-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skb_head. That skb is not released in strp_abort_strp(), which leaks the partially assembled message and can be triggered repeatedly to exhaust memory. Fix this by freeing strp->skb_head and resetting the parser state in the abort path. Leave strp_stop() unchanged so final cleanup still happens in strp_done() after the work and timer have been synchronized.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-06-01
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-46102
EUVD
EUVD-2026-32485
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's stream parser component (strparser). When the stream parser is aborted, such as after a message assembly timeout, it can still hold a reference to a partially assembled message in a buffer called skb_head.

The problem is that this buffer (skb_head) is not released properly in the abort function (strp_abort_strp()), causing a memory leak. This leak can be triggered repeatedly, which may lead to exhaustion of system memory.

The fix involves freeing the skb_head buffer and resetting the parser state during the abort process to prevent the leak, while leaving the final cleanup unchanged.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel, which, if exploited repeatedly, can exhaust system memory.

Exhausting memory can degrade system performance, cause instability, or potentially lead to denial of service conditions where legitimate processes cannot function properly.

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the skb_head leak in strp_abort_strp() has been resolved.

Immediate mitigation involves applying the patch or upgrading the kernel to ensure that strp_abort_strp() properly frees the skb_head and resets the parser state, preventing memory exhaustion.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart