Executive brief
A vulnerability was identified in the Linux kernel's MultiPath TCP (MPTCP) implementation that could cause a system crash (kernel panic). The issue occurs when the system attempts to perform a 'sleepable' operation while holding a lock that requires an atomic (non-sleeping) context. This instability could lead to a denial of service, affecting system availability and ongoing operations.
Technical details
A 'scheduling while atomic' vulnerability exists in net/mptcp/sockopt.c within the Linux kernel. The functions mptcp_setsockopt_sol_socket_tstamp and mptcp_setsockopt_sol_socket_timestamping incorrectly used lock_sock_fast() to protect calls to sock_set_timestamp() and sock_set_timestamping(). Because these helper functions can sleep, calling them within the atomic context provided by lock_sock_fast() triggers a kernel panic. The fix replaces lock_sock_fast() with the sleepable lock_sock()/release_sock() pair. This issue is reachable via local socket option configuration on MPTCP sockets.
Affected products
- Linux Linux kernel All versions supporting MPTCP timestamp propagation to subflows
Timeline
- 2026-04-27: other: Patch authored
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/7eb513b42721bee4b96da69f6188d5a7783f210d
- https://git.kernel.org/stable/c/8a005fe451c73fd2b3d1faa5643c11e6bd07acfc
- https://git.kernel.org/stable/c/b157dab93a7af44a84e78cf0cb311dde475cff5b
- https://git.kernel.org/stable/c/b5c52908d52c6c8eb8933264aa6087a0600fd892
- https://git.kernel.org/stable/c/ebeb70e29e37cfce899309cc2665a3bfe960ed94