{"id":"CVE-2026-68323","state":"PUBLISHED","title":"tipc: serialize udp bearer replicast list updates","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n  list_del corruption. prev->next should be ffff8880298d7ab8,\n    but was ffff88802449ad38. (prev=ffff888027e3ec98)\n  kernel BUG at lib/list_debug.c:62!\n  RIP: __list_del_entry_valid_or_report+0x17a/0x200\n  Workqueue: events cleanup_bearer\n  Call Trace:\n   cleanup_bearer (net/tipc/udp_media.c:811)\n   process_one_work (kernel/workqueue.c:3302)\n   worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions.","publishedAt":"2026-08-10T12:02:59.034Z","updatedAt":"2026-10-30T12:28:23.482Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"c148aec60ef1e806cbc9da44b3d89409df998ade","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"3ff6b534d20824cddab99c81ea3bd1144e635626","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"3ff143a884a19bfcf3aebd999b02274fe44f46f3","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"5d3cea7d41dc72073fea6f879815c9b57c3b330d","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"d70c81001df9320d3445e664428a1d408b5ba896","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"350e592ff4e30e48ffb55e142d11a73e63f4869c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/udp_media.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.9","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/udp_media.c"]}],"references":["https://git.kernel.org/stable/c/c148aec60ef1e806cbc9da44b3d89409df998ade","https://git.kernel.org/stable/c/3ff6b534d20824cddab99c81ea3bd1144e635626","https://git.kernel.org/stable/c/3ff143a884a19bfcf3aebd999b02274fe44f46f3","https://git.kernel.org/stable/c/5d3cea7d41dc72073fea6f879815c9b57c3b330d","https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896","https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-30T12:46:06.359Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68323.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68323","state":"PUBLISHED","datePublished":"2026-08-10T12:02:59.034Z","dateUpdated":"2026-10-30T12:28:23.482Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.382Z"},"containers":{"cna":{"title":"tipc: serialize udp bearer replicast list updates","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n  list_del corruption. prev->next should be ffff8880298d7ab8,\n    but was ffff88802449ad38. (prev=ffff888027e3ec98)\n  kernel BUG at lib/list_debug.c:62!\n  RIP: __list_del_entry_valid_or_report+0x17a/0x200\n  Workqueue: events cleanup_bearer\n  Call Trace:\n   cleanup_bearer (net/tipc/udp_media.c:811)\n   process_one_work (kernel/workqueue.c:3302)\n   worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"c148aec60ef1e806cbc9da44b3d89409df998ade","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"3ff6b534d20824cddab99c81ea3bd1144e635626","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"3ff143a884a19bfcf3aebd999b02274fe44f46f3","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"5d3cea7d41dc72073fea6f879815c9b57c3b330d","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"d70c81001df9320d3445e664428a1d408b5ba896","versionType":"git"},{"version":"ef20cd4dd1633987bcf46ac34ace2c8af212361f","status":"affected","lessThan":"350e592ff4e30e48ffb55e142d11a73e63f4869c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/udp_media.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.9","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/udp_media.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c148aec60ef1e806cbc9da44b3d89409df998ade"},{"url":"https://git.kernel.org/stable/c/3ff6b534d20824cddab99c81ea3bd1144e635626"},{"url":"https://git.kernel.org/stable/c/3ff143a884a19bfcf3aebd999b02274fe44f46f3"},{"url":"https://git.kernel.org/stable/c/5d3cea7d41dc72073fea6f879815c9b57c3b330d"},{"url":"https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896"},{"url":"https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires the local half of the race — enabling and then disabling a TIPC UDP replicast bearer via generic netlink — even though the second half is driven by UDP packets; a purely remote peer cannot schedule cleanup_bearer(), so local access is needed.\nAC:L - The attacker owns both racers: they flood LINK_CONFIG UDP packets at the bearer port (softirq list_add_rcu) while issuing TIPC_NL_BEARER_DISABLE (workqueue list_del_rcu), and the window is wide because b->up is cleared before cleanup_bearer is scheduled, so it can be retried until it hits.\nPR:L - TIPC_NL_BEARER_ENABLE/DISABLE/ADD use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the net's owning user namespace, which any unprivileged user obtains with unshare -Urn; no real root is required.\nUI:N - The attacker performs every step itself — create netns, enable bearer, send packets, disable bearer — with no action by any other user or administrator.\nS:U - The corruption and any resulting escalation stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Concurrent list_add_rcu/list_del_rcu on ub->rcast.list leaves dangling and duplicated entries, so udp_replicast objects freed by rcast_free_rcu remain reachable from the list; the resulting use-after-free reads of attacker-groomed heap memory can disclose arbitrary kernel data.\nI:H - List corruption makes list_add_rcu/list_del_rcu write prev->next and next->prev through stale pointers into freed or attacker-controlled heap memory, a classic write primitive that is leverageable for control-flow hijack and privilege escalation.\nA:H - The reported symptom is a hard kernel BUG at lib/list_debug.c:62 (__list_del_entry_valid_or_report) in the cleanup_bearer workqueue, i.e. an immediate panic; without CONFIG_DEBUG_LIST the corrupted list and freed-entry traversal crash the kernel anyway."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:28:23.482Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68323","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:47:07.182932Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T21:09:04.822Z"}}]}}}