Junglewise Threat Intelligence

CVE-2026-46168: Linux kernel MPTCP denial of service in timestamp sockopt

CVE-2026-46168 · Severity: info · CVSS 0 · Published 2026-05-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation that could cause a system crash (kernel panic). The issue occurs when the system attempts to perform a 'sleepable' operation while holding a lock that requires an atomic (non-sleeping) context. This instability could lead to a denial of service, affecting system availability and ongoing operations.

Technical details

A 'scheduling while atomic' vulnerability exists in net/mptcp/sockopt.c within the Linux kernel. The functions mptcp_setsockopt_sol_socket_tstamp and mptcp_setsockopt_sol_socket_timestamping incorrectly used lock_sock_fast() to protect calls to sock_set_timestamp() and sock_set_timestamping(). Because these helper functions can sleep, calling them within the atomic context provided by lock_sock_fast() triggers a kernel panic. The fix replaces lock_sock_fast() with the sleepable lock_sock()/release_sock() pair. This issue is reachable via local socket option configuration on MPTCP sockets.

Affected products

  • Linux Linux kernel All versions supporting MPTCP timestamp propagation to subflows

Timeline

  • 2026-04-27: other: Patch authored
  • 2026-05-28: disclosed: CVE published

References

Related threats