{"id":"CVE-2026-68323","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothin…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothin…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= ef20cd4dd1633987bcf46ac34ace2c8af212361f < 5d3cea7d41dc72073fea6f879815c9b57c3b330d","Linux >= ef20cd4dd1633987bcf46ac34ace2c8af212361f < d70c81001df9320d3445e664428a1d408b5ba896","Linux >= ef20cd4dd1633987bcf46ac34ace2c8af212361f < 350e592ff4e30e48ffb55e142d11a73e63f4869c","Linux 4.9"],"published":"2026-08-10","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:41.087","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68323","references":[{"url":"https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d3cea7d41dc72073fea6f879815c9b57c3b330d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.0012,"epssPercentile":0.01707,"ingestedAt":"2026-10-15T11:00:41.689Z","slug":"CVE-2026-68323","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n  list_del corruption. prev->next should be ffff8880298d7ab8,\n    but was ffff88802449ad38. (prev=ffff888027e3ec98)\n  kernel BUG at lib/list_debug.c:62!\n  RIP: __list_del_entry_valid_or_report+0x17a/0x200\n  Workqueue: events cleanup_bearer\n  Call Trace:\n   cleanup_bearer (net/tipc/udp_media.c:811)\n   process_one_work (kernel/workqueue.c:3302)\n   worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}