{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68323","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.382Z","datePublished":"2026-08-10T12:02:59.034Z","dateUpdated":"2026-08-17T05:03:21.092Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:03:21.092Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n  list_del corruption. prev->next should be ffff8880298d7ab8,\n    but was ffff88802449ad38. (prev=ffff888027e3ec98)\n  kernel BUG at lib/list_debug.c:62!\n  RIP: __list_del_entry_valid_or_report+0x17a/0x200\n  Workqueue: events cleanup_bearer\n  Call Trace:\n   cleanup_bearer (net/tipc/udp_media.c:811)\n   process_one_work (kernel/workqueue.c:3302)\n   worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires the local half of the race — enabling and then disabling a TIPC UDP replicast bearer via generic netlink — even though the second half is driven by UDP packets; a purely remote peer cannot schedule cleanup_bearer(), so local access is needed.\nAC:L - The attacker owns both racers: they flood LINK_CONFIG UDP packets at the bearer port (softirq list_add_rcu) while issuing TIPC_NL_BEARER_DISABLE (workqueue list_del_rcu), and the window is wide because b->up is cleared before cleanup_bearer is scheduled, so it can be retried until it hits.\nPR:L - TIPC_NL_BEARER_ENABLE/DISABLE/ADD use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the net's owning user namespace, which any unprivileged user obtains with unshare -Urn; no real root is required.\nUI:N - The attacker performs every step itself — create netns, enable bearer, send packets, disable bearer — with no action by any other user or administrator.\nS:U - The corruption and any resulting escalation stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Concurrent list_add_rcu/list_del_rcu on ub->rcast.list leaves dangling and duplicated entries, so udp_replicast objects freed by rcast_free_rcu remain reachable from the list; the resulting use-after-free reads of attacker-groomed heap memory can disclose arbitrary kernel data.\nI:H - List corruption makes list_add_rcu/list_del_rcu write prev->next and next->prev through stale pointers into freed or attacker-controlled heap memory, a classic write primitive that is leverageable for control-flow hijack and privilege escalation.\nA:H - The reported symptom is a hard kernel BUG at lib/list_debug.c:62 (__list_del_entry_valid_or_report) in the cleanup_bearer workqueue, i.e. an immediate panic; without CONFIG_DEBUG_LIST the corrupted list and freed-entry traversal crash the kernel anyway."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/udp_media.c"],"versions":[{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","lessThan":"d70c81001df9320d3445e664428a1d408b5ba896","status":"affected","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","lessThan":"350e592ff4e30e48ffb55e142d11a73e63f4869c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/udp_media.c"],"versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896"},{"url":"https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c"}],"title":"tipc: serialize udp bearer replicast list updates","x_generator":{"engine":"bippy-1.2.0"}}}}