Critical Scheduling Vulnerability in Linux Kernel: CVE-2025-21938
Summary
CVE-2025-21938: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp endpoint i... Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of functionalities, including process management, memory management, and networking. The kernel is crucial for system stability and performance, making it a prime target for vulnerabilities that could compromise system integrity.
Vulnerability Detail
CVE-2025-21938 is a critical vulnerability in the Linux kernel related to the MultiPath TCP (MPTCP) implementation. The issue arises when multiple connection requests attempt to create an implicit MPTCP endpoint in parallel. This can lead to a race condition where concurrent calls to append new local addresses may inadvertently delete existing address entries. The vulnerability is particularly problematic during packet reception, where the caller may be in a read critical section with preemption disabled, potentially leading to system instability and crashes. The stack trace indicates that the issue can trigger a 'scheduling while atomic' bug, which is a serious concern for system reliability.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding the advertisement of endpoints with differing external and internal addresses may reduce the likelihood of triggering the race condition.
Conclusion
CVE-2025-21938 presents a significant risk to systems running vulnerable versions of the Linux kernel, particularly in networking scenarios. It is crucial to apply the recommended updates to mitigate potential impacts on system stability and performance.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21938 is a vulnerability in the Linux kernel's MPTCP implementation that can lead to system instability due to race conditions in address management.
This vulnerability can cause crashes and instability in systems using the affected versions of the Linux kernel, particularly during network operations.
If you are using Debian 12 or 13 with the Linux kernel version prior to 6.12.19-1, your system may be vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, consider minimizing the use of MPTCP or avoiding configurations that may trigger the race condition until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
