CVE-2026-46168: Linux Kernel Race Condition Vulnerability

CVE-2026-46168 Overview

CVE-2026-46168 is a Linux kernel vulnerability in the Multipath TCP (MPTCP) subsystem. The flaw involves an unsafe locking pattern in the timestamp socket option handler. The kernel calls sock_set_timestamp() and sock_set_timestamping() while holding a fast lock acquired via lock_sock_fast(), which places the code in atomic context. Both helpers can sleep, producing a scheduling-while-atomic condition that triggers a kernel panic.

Critical Impact
A local process invoking MPTCP timestamp socket options can trigger a scheduling-while-atomic panic, resulting in denial of service of the affected host.

Affected Products

Linux kernel branches containing the MPTCP timestamp sockopt implementation prior to the referenced stable patches
Distributions shipping vulnerable upstream kernels with MPTCP enabled
Systems exposing MPTCP socket options to local userspace

Discovery Timeline

2026-05-28 - CVE-2026-46168 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46168

Vulnerability Analysis

The vulnerability resides in the MPTCP socket option handling path for timestamp configuration. The code uses lock_sock_fast() to acquire the socket lock around calls to sock_set_timestamp() and sock_set_timestamping(). lock_sock_fast() may take a spinlock and disable preemption, placing the caller in atomic context.

The helpers sock_set_timestamp() and sock_set_timestamping() perform operations that can sleep. Invoking a sleeping function while the kernel is in atomic context violates kernel locking rules. The scheduler responds with a "scheduling while atomic" BUG, which leads to a kernel panic on systems configured to panic on such errors.

The upstream fix replaces lock_sock_fast() and the matching unlock with the sleepable lock_sock() and release_sock() pair. This allows the timestamp helpers to sleep safely without violating preemption constraints. This issue is categorized as a kernel locking defect related to improper synchronization [CWE-667].

Root Cause

The root cause is the use of an atomic-context locking primitive around helpers that may block. lock_sock_fast() is intended for short, non-sleeping critical sections, while sock_set_timestamp() and sock_set_timestamping() perform allocations and other operations that may schedule.

Attack Vector

A local unprivileged process with the ability to open an MPTCP socket and issue the relevant timestamp socket options can trigger the panic. The vector is local and requires no special privileges beyond access to socket APIs. The result is a denial of service through kernel panic, not code execution or privilege escalation.

No verified public exploit code is available. The vulnerability mechanism is described above in prose; refer to the upstream kernel commits for the exact source-level fix.

Detection Methods for CVE-2026-46168

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic referencing MPTCP code paths
Unexpected kernel panics correlated with userspace processes setting SO_TIMESTAMP, SO_TIMESTAMPING, or related options on MPTCP sockets
Repeated host reboots originating from processes that open IPPROTO_MPTCP sockets

Detection Strategies

Inventory running kernel versions against the patched stable trees referenced in the upstream commits and flag hosts on vulnerable builds
Monitor dmesg and /var/log/kern.log for scheduling while atomic traces with MPTCP symbols such as mptcp_setsockopt
Correlate process audit logs with kernel crash events to identify processes invoking MPTCP timestamp options

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on scheduling-while-atomic signatures
Track kdump or pstore crash dumps for MPTCP-related backtraces
Audit which workloads enable MPTCP and review their use of timestamping socket options

How to Mitigate CVE-2026-46168

Immediate Actions Required

Apply the upstream stable kernel patches referenced by the kernel.org commits and reboot affected hosts
Track distribution security advisories for backported fixes and deploy vendor-provided kernel updates
Restrict the ability of untrusted local users to create MPTCP sockets where patching is not yet possible

Patch Information

The upstream fix replaces lock_sock_fast()/unlock_sock_fast() with lock_sock()/release_sock() around the timestamp helper calls in the MPTCP sockopt handler. Patched commits are available at the Kernel Patch Reference, Kernel Commit Change Log, Kernel Security Improvement, Kernel Code Update, and Kernel Code Revision.

Workarounds

Disable MPTCP on hosts that do not require it by setting net.mptcp.enabled=0 via sysctl until patches are applied
Use seccomp or LSM policies to block untrusted processes from creating IPPROTO_MPTCP sockets
Limit local access on multi-tenant systems exposed to untrusted users until kernels are upgraded

bash

# Configuration example: disable MPTCP system-wide as a temporary workaround
sudo sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf