Siemens SIMATIC S7-1500 TM MFP Improper Update of Reference Count (CVE-2026-46099)

high Tenable OT Security Plugin ID 506470

Synopsis

The remote OT asset is affected by a vulnerability.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() unconditionally.
On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can release the underlying pcpu_rt between the lookup and the caching through a concurrent FIB lookup on a shared nexthop.
Simplified race sequence:

ksoftirqd/X higher-prio task (same CPU X)
----------- -------------------------------- seg6_input_core(,skb)/rpl_input(skb) dst_cache_get()
-> miss ip6_route_input(skb)
-> ip6_pol_route(,skb,flags) [RT6_LOOKUP_F_DST_NOREF in flags]
-> FIB lookup resolves fib6_nh [nhid=N route]
-> rt6_make_pcpu_route() [creates pcpu_rt, refcount=1] pcpu_rt->sernum = fib6_sernum [fib6_sernum=W]
-> cmpxchg(fib6_nh.rt6i_pcpu, NULL, pcpu_rt) [slot was empty, store succeeds]
-> skb_dst_set_noref(skb, dst) [dst is pcpu_rt, refcount still 1]

rt_genid_bump_ipv6()
-> bumps fib6_sernum [fib6_sernum from W to Z] ip6_route_output()
-> ip6_pol_route()
-> FIB lookup resolves fib6_nh [nhid=N]
-> rt6_get_pcpu_route() pcpu_rt->sernum != fib6_sernum [W <> Z, stale]
-> prev = xchg(rt6i_pcpu, NULL)
-> dst_release(prev) [prev is pcpu_rt, refcount 1->0, dead]

dst = skb_dst(skb) [dst is the dead pcpu_rt] dst_cache_set_ip6(dst)
-> dst_hold() on dead dst
-> WARN / use-after-free

For the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without PREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release the pcpu_rt. Shared nexthop objects provide such a path, as two routes pointing to the same nhid share the same fib6_nh and its rt6i_pcpu entry.

Fix seg6_input_core() and rpl_input() by calling skb_dst_force() after ip6_route_input() to force the NOREF dst into a refcounted one before caching.
The output path is not affected as ip6_route_output() already returns a refcounted dst.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: High

ID: 506470

File Name: tenable_ot_siemens_CVE-2026-46099.nasl

Version: 1.1

Type: Remote

Family: Tenable.ot

Published: 10/20/2026

Updated: 10/20/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.6

CVSS v3

Risk Factor: High

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/o:siemens:simatic_s7-1500_tm_mfp

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 10/13/2026

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2026-46099

CWE: 911

Detections

Analytics