Linux: Incorrect Behavior Order: Early Amplification
CVE-2026-46015 is a high-severity incorrect behavior order: early amplification vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 7aa7933a5607b1e5b56f322d17265c1d0ea02c51, 14e9bb6eba8f59dcc637702e4744ae5e30660d76, ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 7aa7933a5607b1e5b56f322d17265c1d0ea02c51 or 14e9bb6eba8f59dcc637702e4744ae5e30660d76 or ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b or bebd058ef40c67a81fe6d9ee8beaa4ede90e0704, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.209 or 6.1.175 or 6.6.140 or 6.12.86, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 54b92e84193749c9968aff2dd46e3b0f42643e18 up to, but not including, 7aa7933a5607b1e5b56f322d17265c1d0ea02c51; 54b92e84193749c9968aff2dd46e3b0f42643e18 up to, but not including, 14e9bb6eba8f59dcc637702e4744ae5e30660d76; 54b92e84193749c9968aff2dd46e3b0f42643e18 up to, but not including, ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b; 54b92e84193749c9968aff2dd46e3b0f42643e18 up to, but not including, bebd058ef40c67a81fe6d9ee8beaa4ede90e0704; 54b92e84193749c9968aff2dd46e3b0f42643e18 up to, but not including, 83bb57635d7cbafde32f865b577ecfd969f02337; 54b92e84193749c9968aff2dd46e3b0f42643e18 up to, but not including, 12625b4da84caf4d84a04988710a7b9bcf702b18; 54b92e84193749c9968aff2dd46e3b0f42643e18 up to, but not including, 3864c6ba1e041bc75342353a70fa2a2c6f909923; 5.14 | 7aa7933a5607b1e5b56f322d17265c1d0ea02c51, 14e9bb6eba8f59dcc637702e4744ae5e30660d76, ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b, bebd058ef40c67a81fe6d9ee8beaa4ede90e0704, 83bb57635d7cbafde32f865b577ecfd969f02337, 12625b4da84caf4d84a04988710a7b9bcf702b18 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | all versions | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 5.14 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.140; 6.7 up to, but not including, 6.12.86; 6.13 up to, but not including, 6.18.27; 6.19 up to, but not including, 7.0.4 | 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener gets a new accept-queue entry via inet_csk_reqsk_queue_add(), but that path never notifies the target listener's waiters. A nonblocking accept() still works because it checks the queue directly, but poll()/epoll_wait() waiters and blocking accept() callers can also remain asleep indefinitely. Call READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration in inet_csk_listen_stop(). However, after inet_csk_reqsk_queue_add() succeeds, the ref acquired in reuseport_migrate_sock() is effectively transferred to nreq->rsk_listener. Another CPU can then dequeue nreq via accept() or listener shutdown, hit reqsk_put(), and drop that listener ref. Since listeners are SOCK_RCU_FREE, wrap the post-queue_add() dereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also covers the existing sock_net(nsk) access in that path. The reqsk_timer_handler() path does not need the same changes for two reasons: half-open requests become readable only after the final ACK, where tcp_child_process() already wakes the listener; and once nreq is visible via inet_ehash_insert(), the success path no longer touches nsk directly.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incorrect Behavior Order: Early Amplification
The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
More Incorrect Behavior Order: Early Amplification vulnerabilities (CWE-408)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/12625b4da84caf4d84a04988710a7b9bcf702b18
- git.kernel.org/stable/c/14e9bb6eba8f59dcc637702e4744ae5e30660d76
- git.kernel.org/stable/c/3864c6ba1e041bc75342353a70fa2a2c6f909923
- git.kernel.org/stable/c/7aa7933a5607b1e5b56f322d17265c1d0ea02c51
- git.kernel.org/stable/c/83bb57635d7cbafde32f865b577ecfd969f02337
- git.kernel.org/stable/c/ab5fdcd535645f6dbe6e9e21d96a08d141e88b4b
- git.kernel.org/stable/c/bebd058ef40c67a81fe6d9ee8beaa4ede90e0704
Other references
Recent Incorrect Behavior Order: Early Amplification vulnerabilities
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.