CVE-2026-68438

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smp: Make CSD lock acquisition atomic for debug mode

Commit b0473dcd4b1d ("smp: Improve smp_call_function_single()

CSD-lock diagnostics") changed smp_call_function_single() so that,

when CSD lock debugging is enabled, async !wait calls use the

destination CPU csd_data. That improves diagnostics, but it also removes

the single-writer property that made the old csd_lock() safe: multiple

CPUs can now prepare the same destination CPU CSD concurrently.

csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the

bit with a non-atomic read-modify-write. Two senders can both see an

unlocked CSD, set the bit, overwrite the callback fields, and enqueue

the same llist node. Re-adding a node that is already the queue head can

make node->next point to itself, leaving the target CPU stuck walking

call_single_queue. Later synchronous work, such as a TLB shootdown, can

then remain queued and trigger soft-lockup warnings

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References