CVE-2026-68323

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: serialize udp bearer replicast list updates

tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with

list_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs

from the encap receive softirq (via tipc_udp_rcast_disc()) without

rtnl_lock(), so it can race the cleanup delete and corrupt the list:

list_del corruption. prev->next should be ffff8880298d7ab8,

but was ffff88802449ad38. (prev=ffff888027e3ec98)

kernel BUG at lib/list_debug.c:62!

RIP: __list_del_entry_valid_or_report+0x17a/0x200

Workqueue: events cleanup_bearer

Call Trace:

cleanup_bearer (net/tipc/udp_media.c:811)

process_one_work (kernel/workqueue.c:3302)

worker_thread (kernel/workqueue.c:3466)

The bearer can be enabled from an unprivileged user namespace, as the

TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.

Add a spinlock to struct udp_bearer and take it around the list_add_rcu()

in tipc

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References