CVE-2026-46168

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. This vulnerability stems from an unsafe operation where lock_sock_fast(), intended for atomic contexts, is used with functions like sock_set_timestamp() and sock_set_timestamping() that can cause the system to sleep. Such an operation can lead to a 'scheduling while atomic panic', effectively allowing a local user to trigger a system crash and cause a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because exploitation is constrained to authenticated local users and results exclusively in a denial of service without compromising confidentiality or integrity. By configuring timestamp socket options on Multipath TCP connections, a local attacker can induce a sleep in an atomic context, resulting in a kernel panic. The issue cannot be exploited remotely and does not facilitate privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.