What’s Vulnerable › Vulnerabilities

CVE-2026-46168: mptcp: fix scheduling with atomic in timestamp sockopt

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-28 · updated 2026-10-15

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix scheduling with atomic in timestamp sockopt Using lock_sock_fast() (atomic context) around sock_set_timestamp() and sock_set_timestamping() is unsafe, as both helpers can sleep. Replace lock_sock_fast() with sleepable lock_sock()/release_sock() to avoid scheduling while atomic panic.

Affected products

• Linux kernel: from 5.14 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7 — fixed in 5.15.209, 6.1.175, 6.12.88, 6.18.30, 6.6.140, 7.0.7

How to fix

Upgrade to a fixed version: Linux kernel 5.15.209, 6.1.175, 6.12.88, 6.18.30. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0949d8bbbedbafe0136a1723c41eb823c2f1e09d
• https://git.kernel.org/stable/c/7eb513b42721bee4b96da69f6188d5a7783f210d
• https://git.kernel.org/stable/c/8a005fe451c73fd2b3d1faa5643c11e6bd07acfc
• https://git.kernel.org/stable/c/b157dab93a7af44a84e78cf0cb311dde475cff5b
• https://git.kernel.org/stable/c/b5c52908d52c6c8eb8933264aa6087a0600fd892
• https://git.kernel.org/stable/c/e792cfb6aeaf65612cdf8e3ac431d65e66283654
• https://git.kernel.org/stable/c/ebeb70e29e37cfce899309cc2665a3bfe960ed94
• https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Get alerted when CVE-2026-46168 or the next vulnerability affects your stack