CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race

Synopsis

A data race vulnerability exists in the Linux kernel's Multipath TCP (MPTCP) path manager, specifically in the ADD_ADDR retransmission timer handler. The flaw is reachable over the network without any authentication or user interaction, as derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation gives an attacker full read, write, and availability impact on the affected system, including the ability to disclose sensitive data, tamper with memory, or crash the kernel. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network, meaning an attacker must be able to send traffic to the affected host to trigger the race condition in the MPTCP timer handler.

• AuthenticationNot required

  No authentication is needed; the attack can be initiated by any unauthenticated network peer.

• Victim interactionNot required

  No user or administrator action is required to trigger exploitation; the vulnerability fires through the kernel's own timer subsystem.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit does not depend on race windows, special memory layouts, or environmental preconditions beyond network access.

Blast Radius

• An attacker can read kernel memory contents, exposing in-flight network data, session tokens, or other sensitive process information held in kernel buffers.
• An attacker can corrupt kernel memory structures via the unsynchronized timer callback, enabling arbitrary write primitives within the affected kernel context.
• The race condition can be used to crash the kernel entirely, taking down all workloads on the host and causing a full service outage.
• Container workloads sharing the host kernel are all affected; a successful exploit against the kernel is not bounded by container isolation boundaries.