CVE-2026-52945

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Revert "wireguard: device: enable threaded NAPI"

This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is

commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream.

We have had three independent production user reports in combination

with Cilium utilizing WireGuard as encryption underneath that k8s Pod

E/W traffic to certain peer nodes fully stalled. The situation appears

as follows:

- Occurs very rarely but at random times under heavy networking load.

- Once the issue triggers the decryption side stops working completely

for that WireGuard peer, other peers keep working fine. The stall

happens also for newly initiated connections towards that particular

WireGuard peer.

- Only the decryption side is affected, never the encryption side.

- Once it triggers, it never recovers and remains in this state,

the CPU/mem on that node looks normal, no leak, busy loop or crash.

- bpftrace

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References