Skip to content
Heist/ feed
High

mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may end up in mptcp_pm_nl_append_new_local_addr because none found the address in local_addr_list during their call to mptcp_pm_nl_get_local_id. In this case, the concurrent new_local_addr calls may delete the address entry created by the previous caller. These deletes use synchronize_rcu, but this is not permitted in some of the contexts where this function may be called. During packet recv, the caller may be in a rcu read critical section and have preemption disabled. An example stack: BUG: scheduling while atomic: swapper/2/0/0x00000302 Call Trace: dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) dump_stack (lib/dump_stack.c:124) __schedule_bug (kernel/sched/core.c:5943) schedule_debug.constprop.0 (arch/x86/include/asm/preempt.h:33 kernel/sched/core.c:5970) __schedule (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207 kernel/sched/features.h:29 kernel/sched/core.c:6621) schedule (arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6804 kernel/sched/core.c:6818) schedule_timeout (kernel/time/timer.c:2160) wait_for_completion (kernel/sched/completion.c:96 kernel/sched/completion.c:116 kernel/sched/completion.c:127 kernel/sched/completion.c:148) __wait_rcu_gp (include/linux/rcupdate.h:311 kernel/rcu/u

Announced Source revision 1
Original source ↗

CVE-2025-21938

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-21938

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
        "lessThan": "f1404f368c40fc6a068dad72e4ee0824ee6a78ee",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
        "lessThan": "f3fcdb2de9fdbed9d8c6a8eb2c5fbd7d6f54a4d8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
        "lessThan": "4b228dae3d2cc6d9dce167449cd8fa9f028e9376",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
        "lessThan": "125ccafe6dd062901b5a0c31ee9038740fc8859e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d045b9eb95a9b611c483897a69e7285aefdc66d7",
        "lessThan": "022bfe24aad8937705704ff2e414b100cf0f2e1a",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/mptcp/pm_netlink.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.18"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.18",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.131",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.83",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.19",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13.7",
        "versionType": "semver",
        "lessThanOrEqual": "6.13.*"
      },
      {
        "status": "unaffected",
        "version": "6.14",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/mptcp/pm_netlink.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-21938

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30446 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement