CVE-2026-68313: Linux Kernel TIPC DoS Vulnerability

CVE-2026-68313 Overview

CVE-2026-68313 is a Linux kernel vulnerability in the Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in the __tipc_nl_compat_dumpit function, where the cmd->dumpit callback can return a negative errno value. Because the surrounding while(len) loop does not check for negative return codes, the loop never terminates. The affected code path holds genl_mutex, so all other tasks waiting on the generic netlink mutex block indefinitely in uninterruptible (D) state. The upstream fix validates the return value from dumpit, propagates the error, and jumps to err_out on failure.

Critical Impact
A local user can trigger an unrecoverable infinite loop in kernel context that starves other netlink operations and causes a system-wide denial of service.

Affected Products

Linux kernel versions containing the vulnerable __tipc_nl_compat_dumpit implementation in net/tipc/netlink_compat.c
Distributions shipping affected upstream kernels with the TIPC module enabled
Stable kernel branches referenced by commits 1ab78af, 22f8aa3, b8f3b8e, e740e90, and f9c669d

Discovery Timeline

2026-08-10 - CVE-2026-68313 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68313

Vulnerability Analysis

The TIPC netlink compatibility layer processes legacy dump requests through __tipc_nl_compat_dumpit. The function iterates while len remains non-zero and invokes a per-command dumpit callback on each pass. The callback's contract permits returning a negative errno on failure, but the calling loop treats any non-positive result as continuation input. When dumpit returns an error such as -ENOMEM or -EINVAL, the loop condition never resolves and execution stays inside the kernel indefinitely.

The function holds genl_mutex throughout this path. Every other generic netlink operation across the system blocks on that mutex, including unrelated networking configuration commands. Threads waiting on the mutex enter uninterruptible sleep and cannot be killed, requiring a reboot to recover.

Root Cause

The root cause is missing return-value validation. The while(len) condition assumes forward progress but does not verify that the dumpit callback succeeded. A negative return value is silently ignored, producing an [Infinite Loop] denial-of-service condition inside the kernel.

Attack Vector

An unprivileged local process with the ability to send TIPC netlink compatibility messages can trigger the condition. Reaching the vulnerable path requires crafting a legacy TIPC dump request that causes the corresponding dumpit callback to fail with a negative errno. No memory corruption or code execution occurs; the impact is confined to availability. The vulnerability is not exploitable remotely without prior local access to the netlink interface.

See the upstream commits Kernel Git Commit 1ab78af and Kernel Git Commit f9c669d for the fix implementation.

Detection Methods for CVE-2026-68313

Indicators of Compromise

Processes stuck in uninterruptible sleep (D state) with stack traces referencing genl_mutex or __tipc_nl_compat_dumpit
Sustained 100% CPU utilization on a single kernel thread executing inside the TIPC netlink compatibility path
Generic netlink operations (for example, ip, tc, ss) hanging system-wide with no obvious workload change

Detection Strategies

Monitor /proc/<pid>/stack and /proc/<pid>/wchan for tasks blocked on genl_lock or waiting inside netlink_compat
Alert on kernel soft-lockup messages (watchdog: BUG: soft lockup) referencing TIPC symbols in dmesg
Track unexpected loading of the tipc kernel module on hosts that do not require inter-process cluster communication

Monitoring Recommendations

Collect kernel logs centrally and search for hung_task warnings naming TIPC or generic netlink functions
Baseline the set of processes that legitimately open AF_NETLINK sockets with NETLINK_GENERIC and flag deviations
Instrument host telemetry to capture per-CPU kernel-mode time spikes that correlate with TIPC netlink activity

How to Mitigate CVE-2026-68313

Immediate Actions Required

Apply the upstream stable kernel update containing commits 1ab78af, 22f8aa3, b8f3b8e, e740e90, or f9c669d as shipped by your distribution
Unload the tipc module on systems that do not use TIPC clustering with modprobe -r tipc
Blacklist the tipc module to prevent auto-load through netlink socket creation

Patch Information

The fix adds a check on the return value of cmd->dumpit. When the callback returns a negative errno, the function propagates the error and jumps to err_out, releasing genl_mutex and terminating the dump. Patched trees are available at Kernel Git Commit 22f8aa3, Kernel Git Commit b8f3b8e, and Kernel Git Commit e740e90.

Workarounds

Add install tipc /bin/true to /etc/modprobe.d/blacklist-tipc.conf to prevent module auto-loading
Restrict CAP_NET_ADMIN and access to AF_NETLINK sockets on multi-tenant hosts until patches are deployed
Use seccomp or LSM policies to deny socket(AF_NETLINK, ...) for workloads that do not require netlink

bash

# Prevent the vulnerable TIPC module from loading
echo 'install tipc /bin/true' | sudo tee /etc/modprobe.d/blacklist-tipc.conf
sudo modprobe -r tipc 2>/dev/null || true
lsmod | grep -q '^tipc' && echo 'tipc still loaded' || echo 'tipc unloaded'