CVE-2026-46168

Technical summary

CVE-2026-46168 involves a scheduling-while-atomic bug in the Linux kernel's MPTCP subsystem. The vulnerable code path uses lock_sock_fast(), which operates in atomic context and disables preemption, while subsequently calling sock_set_timestamp() and sock_set_timestamping(). Both of these helper functions perform operations that may sleep (such as memory allocation or mutex operations), creating a dangerous condition. When a sleeping operation occurs while holding an atomic lock, the kernel panics with a 'scheduling while atomic' error. The fix replaces the atomic lock_sock_fast() with the sleepable lock_sock() and release_sock() pair, allowing safe execution of timestamp configuration.

Business impact

This vulnerability enables local denial-of-service attacks against any Linux system running an affected kernel version. An unprivileged user can crash the system without requiring root access, causing service interruption, data loss risk during uncontrolled shutdown, and operational disruption. For cloud providers and multi-tenant environments, a single compromised or malicious user account can impact all tenants on the affected host. The attack requires no special tools or exploit code—only standard socket programming capabilities—making it trivially accessible to attackers.

Affected systems

The Linux kernel is affected, specifically versions that include the vulnerable MPTCP timestamp socket option handling code path. Determine which kernel versions in your infrastructure may be impacted by cross-referencing your current kernel versions against the Linux kernel security advisories and vendor patches. Both stable and long-term support kernels may be affected depending on their release date and maintenance status relative to the vulnerability discovery date of 2026-05-28.

Exploitability

Exploitability is relatively high for local attackers. The attack requires only local user access (no root privileges needed) and involves triggering the vulnerable code path through standard socket operations—specifically manipulation of timestamp socket options on MPTCP-enabled connections. No special knowledge of kernel internals, no race conditions requiring precise timing, and no complex setup is required. However, remote exploitation is not possible; attackers must have a local account on the target system. The lack of KEV (Known Exploited Vulnerability) status does not indicate absence of active exploitation.

Remediation

Apply kernel updates provided by your Linux distribution that include the scheduling-while-atomic fix for MPTCP timestamp handling. Verify that your kernel version incorporates the change replacing lock_sock_fast() with lock_sock()/release_sock() around timestamp socket option calls. If immediate patching is not possible, restrict local user account creation and implement strict access controls to limit the number of users who can access affected systems. Monitor for kernel panic logs containing 'scheduling while atomic' messages as an indicator of attempted or successful exploitation.

Patch guidance

Contact your Linux distribution vendor or check their security advisory repository for a kernel update addressing this issue. Patch availability and timing vary by distribution and kernel branch (mainline, stable, LTS). Test any kernel updates in a non-production environment first to ensure compatibility with your workloads. Coordinate with your infrastructure team to schedule reboots required for kernel updates. Verify the patched kernel version contains the commit that replaces lock_sock_fast() with sleepable locking in the MPTCP timestamp path by reviewing the distribution's security advisory or kernel changelog.

Detection guidance

Monitor system logs for 'BUG: scheduling while atomic' kernel panic messages, particularly those originating from MPTCP or socket option handling code paths. Enable kernel debugging if operationally feasible to capture more detailed stack traces. Correlate such panics with recent socket option calls or connections using MPTCP. Implement process monitoring to detect repeated socket option modifications that might indicate exploitation attempts. Check running kernel version against known-patched versions using tools like 'uname -r' and cross-reference against your vendor's advisory.

Why prioritize this

This vulnerability scores MEDIUM (5.5) due to the requirement for local access and the limitation to denial-of-service impact (no code execution or data breach). However, prioritize patching in environments with high local user density (shared systems, CI/CD runners, container clusters), multi-tenant cloud platforms, and systems where unavailability carries operational or financial consequences. The simplicity of exploitation and the lack of privilege escalation requirements warrant faster remediation than the CVSS score alone might suggest for high-availability deployments.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (requires local access), Attack Complexity Low (straightforward to trigger), Privileges Required Low (standard user can exploit), User Interaction None (no user action needed), and Impact limited to Availability (denial of service only—no confidentiality or integrity impact). The score appropriately penalizes the local-only attack surface but recognizes the severity of denial-of-service impact to system stability. Organizations running high-availability services or with extensive local user populations should treat this as higher priority than the base score indicates.

Frequently asked questions