mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may end up in mptcp_pm_nl_append_new_local_addr because none found the address in local_addr_list during their call to mptcp_pm_nl_get_local_id. In this case, the concurrent new_local_addr calls may delete the address entry created by the previous caller. These deletes use synchronize_rcu, but this is not permitted in some of the contexts where this function may be called. During packet recv, the caller may be in a rcu read critical section and have preemption disabled. An example stack: BUG: scheduling while atomic: swapper/2/0/0x00000302 Call Trace: dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) dump_stack (lib/dump_stack.c:124) __schedule_bug (kernel/sched/core.c:5943) schedule_debug.constprop.0 (arch/x86/include/asm/preempt.h:33 kernel/sched/core.c:5970) __schedule (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207 kernel/sched/features.h:29 kernel/sched/core.c:6621) schedule (arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6804 kernel/sched/core.c:6818) schedule_timeout (kernel/time/timer.c:2160) wait_for_completion (kernel/sched/completion.c:96 kernel/sched/completion.c:116 kernel/sched/completion.c:127 kernel/sched/completion.c:148) __wait_rcu_gp (include/linux/rcupdate.h:311 kernel/rcu/u
CVE-2025-21938
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-21938
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
"lessThan": "f1404f368c40fc6a068dad72e4ee0824ee6a78ee",
"versionType": "git"
},
{
"status": "affected",
"version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
"lessThan": "f3fcdb2de9fdbed9d8c6a8eb2c5fbd7d6f54a4d8",
"versionType": "git"
},
{
"status": "affected",
"version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
"lessThan": "4b228dae3d2cc6d9dce167449cd8fa9f028e9376",
"versionType": "git"
},
{
"status": "affected",
"version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
"lessThan": "125ccafe6dd062901b5a0c31ee9038740fc8859e",
"versionType": "git"
},
{
"status": "affected",
"version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
"lessThan": "022bfe24aad8937705704ff2e414b100cf0f2e1a",
"versionType": "git"
}
],
"programFiles": [
"net/mptcp/pm_netlink.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.131",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.83",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.19",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.13.7",
"versionType": "semver",
"lessThanOrEqual": "6.13.*"
},
{
"status": "unaffected",
"version": "6.14",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mptcp/pm_netlink.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-21938
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30446 · Revision 1
- Added to Heist Feed
- Publisher date