CVE-2025-21938

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) subsystem, which allows a remote attacker to cause a Denial of Service (DoS). When multiple concurrent connection requests attempt to establish implicit MPTCP endpoints simultaneously, a race condition occurs. This condition forces the kernel to execute a blocking synchronization routine within an atomic context where sleeping is prohibited, resulting in a kernel panic and system crash.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation is limited to a denial of service condition without compromising data confidentiality or system integrity. Triggering the crash requires Multipath TCP (MPTCP) to be actively utilized and processing concurrent subflow connection requests, which introduces a race condition during endpoint address resolution in an atomic context. Systems that do not use MPTCP or operate with standard TCP deployments are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.