{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68323", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.382Z", "datePublished": "2026-08-10T12:02:59.034Z", "dateUpdated": "2026-08-17T05:03:21.092Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:03:21.092Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n list_del corruption. prev->next should be ffff8880298d7ab8,\n but was ffff88802449ad38. (prev=ffff888027e3ec98)\n kernel BUG at lib/list_debug.c:62!\n RIP: __list_del_entry_valid_or_report+0x17a/0x200\n Workqueue: events cleanup_bearer\n Call Trace:\n cleanup_bearer (net/tipc/udp_media.c:811)\n process_one_work (kernel/workqueue.c:3302)\n worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires the local half of the race — enabling and then disabling a TIPC UDP replicast bearer via generic netlink — even though the second half is driven by UDP packets; a purely remote peer cannot schedule cleanup_bearer(), so local access is needed.\nAC:L - The attacker owns both racers: they flood LINK_CONFIG UDP packets at the bearer port (softirq list_add_rcu) while issuing TIPC_NL_BEARER_DISABLE (workqueue list_del_rcu), and the window is wide because b->up is cleared before cleanup_bearer is scheduled, so it can be retried until it hits.\nPR:L - TIPC_NL_BEARER_ENABLE/DISABLE/ADD use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the net's owning user namespace, which any unprivileged user obtains with unshare -Urn; no real root is required.\nUI:N - The attacker performs every step itself — create netns, enable bearer, send packets, disable bearer — with no action by any other user or administrator.\nS:U - The corruption and any resulting escalation stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Concurrent list_add_rcu/list_del_rcu on ub->rcast.list leaves dangling and duplicated entries, so udp_replicast objects freed by rcast_free_rcu remain reachable from the list; the resulting use-after-free reads of attacker-groomed heap memory can disclose arbitrary kernel data.\nI:H - List corruption makes list_add_rcu/list_del_rcu write prev->next and next->prev through stale pointers into freed or attacker-controlled heap memory, a classic write primitive that is leverageable for control-flow hijack and privilege escalation.\nA:H - The reported symptom is a hard kernel BUG at lib/list_debug.c:62 (__list_del_entry_valid_or_report) in the cleanup_bearer workqueue, i.e. an immediate panic; without CONFIG_DEBUG_LIST the corrupted list and freed-entry traversal crash the kernel anyway." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tipc/udp_media.c" ], "versions": [ { "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f", "lessThan": "d70c81001df9320d3445e664428a1d408b5ba896", "status": "affected", "versionType": "git" }, { "version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f", "lessThan": "350e592ff4e30e48ffb55e142d11a73e63f4869c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tipc/udp_media.c" ], "versions": [ { "version": "4.9", "status": "affected" }, { "version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896" }, { "url": "https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c" } ], "title": "tipc: serialize udp bearer replicast list updates", "x_generator": { "engine": "bippy-1.2.0" } } } }