{"id":"CVE-2026-68323","summary":"tipc: serialize udp bearer replicast list updates","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub-\u003ercast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n  list_del corruption. prev-\u003enext should be ffff8880298d7ab8,\n    but was ffff88802449ad38. (prev=ffff888027e3ec98)\n  kernel BUG at lib/list_debug.c:62!\n  RIP: __list_del_entry_valid_or_report+0x17a/0x200\n  Workqueue: events cleanup_bearer\n  Call Trace:\n   cleanup_bearer (net/tipc/udp_media.c:811)\n   process_one_work (kernel/workqueue.c:3302)\n   worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions.","modified":"2026-08-15T11:31:11.354674313Z","published":"2026-08-10T12:02:59.034Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68323.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68323.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68323"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ef20cd4dd1633987bcf46ac34ace2c8af212361f"},{"fixed":"d70c81001df9320d3445e664428a1d408b5ba896"},{"fixed":"350e592ff4e30e48ffb55e142d11a73e63f4869c"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68323.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68323.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}