CVE-2026-68313

Received Received - Intake

TIPC Infinite Loop in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in __tipc_nl_compat_dumpit cmd->dumpit callback can return a negative errno, causing an infinite loop due to the while(len) condition. As the loop never terminates, genl_mutex is never released, and other tasks waiting on it starve in D state. Check dumpit's return value, propagate it and jump to err_out on error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68313

EUVD

EUVD-2026-55414

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a function called __tipc_nl_compat_dumpit can enter an infinite loop if it receives a negative error code. The loop condition while(len) never becomes false, preventing the function from exiting. This also blocks the genl_mutex, causing other processes to hang indefinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's TIPC module and may not have direct network detection commands. Monitor kernel logs for processes stuck in D state due to genl_mutex starvation. Check for infinite loops in tipc-related operations using system monitoring tools like top, htop, or dmesg.

Impact Analysis

This vulnerability can cause system hangs or crashes. If exploited, it may lead to denial-of-service conditions where the affected system becomes unresponsive. Users may experience system freezes or require a reboot to restore normal operation.

Compliance Impact

This vulnerability causes an infinite loop in the Linux kernel's TIPC module, leading to a denial of service by starving tasks waiting on genl_mutex. This could disrupt system availability, potentially violating compliance requirements for availability in standards like GDPR (data processing integrity) and HIPAA (system availability for protected health information).

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-68313. If immediate patching is not possible, consider disabling the TIPC module if it is not required by your system.

Hi! I’m here to help you understand CVE-2026-68313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70