[SRU][Q][PATCH 0/1] CVE-2026-46137

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-46137

[ Impact ]

The mptcp_pm_add_timer() helper runs as a timer callback in softirq context but
did not hold the socket lock, leaving it open to a data race. Concurrent access
to the socket state from the timer callback and other paths could corrupt MPTCP
path manager state handling the ADD_ADDR retransmission. Given the network-
reachable nature of MPTCP, this race could be triggered remotely and lead to
memory corruption or denial of service.

[ Fix ]

questing: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix would affect the MPTCP path manager subsystem,
specifically ADD_ADDR retransmission timer handling. Incorrect locking with
bh_lock_sock() could introduce deadlocks or fail to reschedule the timer when
the socket is in use, disrupting MPTCP address advertisement.