CVE-2026-68323
Received Received - Intake

TIPC UDP Bearer List Corruption via Race Condition

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tipc: serialize udp bearer replicast list updates tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with list_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs from the encap receive softirq (via tipc_udp_rcast_disc()) without rtnl_lock(), so it can race the cleanup delete and corrupt the list: list_del corruption. prev->next should be ffff8880298d7ab8, but was ffff88802449ad38. (prev=ffff888027e3ec98) kernel BUG at lib/list_debug.c:62! RIP: __list_del_entry_valid_or_report+0x17a/0x200 Workqueue: events cleanup_bearer Call Trace: cleanup_bearer (net/tipc/udp_media.c:811) process_one_work (kernel/workqueue.c:3302) worker_thread (kernel/workqueue.c:3466) The bearer can be enabled from an unprivileged user namespace, as the TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM. Add a spinlock to struct udp_bearer and take it around the list_add_rcu() in tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so the two writers can no longer corrupt the list. Reject a duplicate peer under the same lock before allocating, and remove tipc_udp_is_known_peer(). The old lockless pre-check in tipc_udp_rcast_disc() was racy: two softirqs discovering the same peer could both find it absent and add it twice. cleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the bearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add() and add a peer after cleanup_bearer() has already emptied the list, leaking that entry when the bearer is freed. Mark the bearer disabled under rcast_lock once the list is emptied and refuse further additions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68323
EUVD
EUVD-2026-55424

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the TIPC (Transparent Inter-Process Communication) module. It involves a race condition where two functions, tipc_udp_rcast_add() and cleanup_bearer(), can simultaneously modify a shared list without proper synchronization. This leads to list corruption, causing kernel crashes with errors like 'list_del corruption' and potential system instability.

Detection Guidance

This vulnerability affects the TIPC (Transparent Inter-Process Communication) module in the Linux kernel, specifically the UDP bearer implementation. Detection requires checking if TIPC is enabled and if the vulnerable code path is reachable. Commands to check TIPC status: lsmod | grep tipc, modinfo tipc. Monitor kernel logs for list corruption errors or BUG messages related to list_del corruption in TIPC modules.

Impact Analysis

An attacker with access to a user namespace could exploit this to crash the system by triggering the race condition. This may result in denial-of-service (DoS) conditions, system freezes, or kernel panics. Systems using TIPC with UDP bearers are particularly at risk.

Mitigation Strategies

Immediate mitigation involves disabling the TIPC module if not in use: rmmod tipc. If TIPC is required, ensure your Linux kernel is updated to a patched version where this issue is resolved. Kernel updates should be applied via your distribution's package manager (e.g., apt upgrade, yum update).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart