KernelScan.io

HIGH

net/strparser SkbHead Leak

CVE-2026-46102

CVSS 7.5 / 10.0 NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

KernelScan AI7.5HIGH

01

In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skb_head. That skb is not released in strp_abort_strp(), which leaks the partially assembled message and can be triggered repeatedly to exhaust memory. Fix this by freeing strp->skb_head and resetting the parser state in the abort path. Leave strp_stop() unchanged so final cleanup still happens in strp_done() after the work and timer have been synchronized.

02

Engine v0.2.0

Risk summary

Remote attackers can exhaust system memory by repeatedly triggering stream parser aborts that leak partially assembled message buffers. This affects any system processing TCP streams through the kernel's stream parser, potentially causing denial of service through memory exhaustion.

Affectednet/strparser/strparser.c (stream parser)

Vulnerability analysis

The stream parser fails to release partially assembled messages in strp->skb_head when strp_abort_strp() is called, such as during message assembly timeouts. The fix adds proper cleanup by calling kfree_skb() and resetting parser state variables. This is remotely exploitable via TCP connections by sending malformed messages that trigger parser timeouts, with no privileges required.

03

BranchFixed inPatch commit
5.105.10.258d6668ce0e78d
5.155.15.209a470ed71c906
6.16.1.175c2e57695ec9f
6.126.12.865327dad2ffe9
6.186.18.2719ca9475f18f
6.66.6.140e9ae00490d47
7.07.0.456082f442023
mainline7.1-rc1fe72340daaf1