CVE-2026-68334

Received Received - Intake

Race Condition in Linux Kernel rxrpc Component

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() rxrpc_wake_up_io_thread() checks local->io_thread before waking it, but then reloads the pointer for wake_up_process(). local->io_thread is cleared with WRITE_ONCE() when the I/O thread exits, so the second load can see NULL even if the first load did not. Take a READ_ONCE() snapshot and use it for both the NULL check and the wake_up_process() call, as rxrpc_encap_rcv() already does.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68334

EUVD

EUVD-2026-55435

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a race condition in the Linux kernel's rxrpc component. The function rxrpc_wake_up_io_thread() checks if an I/O thread exists before waking it, but then reloads the thread pointer for the wake-up call. If the thread exits between these steps, the pointer may become NULL, causing a potential issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's rxrpc subsystem and may not have direct detection commands. Monitor kernel logs for rxrpc-related errors or crashes. Check for unusual network activity involving rxrpc services. Ensure your kernel is updated to the patched version.

Impact Analysis

This vulnerability could lead to system instability or crashes if the I/O thread is not properly managed during wake-up operations. It may cause unexpected behavior in network services relying on rxrpc.

Compliance Impact

This vulnerability is a race condition in the Linux kernel's rxrpc module that could lead to improper thread handling. It does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue rather than a data protection or privacy violation.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-68334. If immediate patching is not possible, consider disabling the rxrpc module if not in use. Monitor system logs for signs of exploitation or instability.

Hi! I’m here to help you understand CVE-2026-68334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70