CVE-2026-68323: Linux Kernel Race Condition Vulnerability

CVE-2026-68323 Overview

CVE-2026-68323 is a race condition vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in the UDP bearer replicast list management, where tipc_udp_rcast_add() and cleanup_bearer() both mutate ub->rcast.list without proper serialization. Concurrent execution from an encapsulation receive softirq and a workqueue can corrupt the linked list, triggering a kernel BUG at lib/list_debug.c:62.

The TIPCv2 generic-netlink operations do not enforce GENL_ADMIN_PERM, so an unprivileged user namespace can enable the bearer and reach the racy code path.

Critical Impact
Local unprivileged users can corrupt kernel memory through a TIPC UDP bearer race, leading to kernel panic or potential privilege escalation.

Affected Products

Linux kernel (mainline) prior to the fix commit d70c81001df9
Linux stable kernel branches including TIPC UDP media support
Distributions shipping vulnerable kernels with the tipc module loadable

Discovery Timeline

2026-08-10 - CVE-2026-68323 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68323

Vulnerability Analysis

The vulnerability is a race condition in the TIPC UDP media driver at net/tipc/udp_media.c. Two writers modify the replicast peer list concurrently. tipc_udp_rcast_add() runs from the encapsulation receive softirq context via tipc_udp_rcast_disc() and does not hold rtnl_lock(). cleanup_bearer() runs from a workqueue during bearer teardown. Both call list_add_rcu() or list_del_rcu() on ub->rcast.list without a mutual exclusion primitive.

When the softirq and workqueue interleave, the list's prev/next pointers become inconsistent. The kernel's list debugging code detects the corruption and panics with list_del corruption. prev->next should be ....

A secondary issue exists in tipc_udp_rcast_disc(), which used a lockless pre-check via tipc_udp_is_known_peer(). Two softirqs discovering the same peer could both observe it as absent and add duplicate entries.

A third issue arises during teardown: after tipc_udp_disable() clears the bearer's up bit, an in-flight softirq can still call tipc_udp_rcast_add() and add a peer after cleanup_bearer() has emptied the list, leaking that entry when the bearer is freed.

Root Cause

Missing synchronization between softirq-driven list insertion and workqueue-driven list deletion on a shared RCU-protected linked list within struct udp_bearer. RCU protects readers but not concurrent writers.

Attack Vector

A local attacker with the ability to create a user namespace can enable a TIPC UDP bearer without root privileges because the generic-netlink ops omit GENL_ADMIN_PERM. The attacker then triggers concurrent replicast discovery and bearer cleanup to race the list operations, corrupting kernel memory. Exploitation requires local access.

Refer to the upstream fix commit and the companion commit for the full patch.

Detection Methods for CVE-2026-68323

Indicators of Compromise

Kernel oops or panic messages containing list_del corruption with the call trace referencing cleanup_bearer and net/tipc/udp_media.c
Unexpected loading of the tipc kernel module on hosts that do not use TIPC
Creation of unprivileged user namespaces followed by TIPC netlink activity

Detection Strategies

Audit auditd or eBPF telemetry for unshare(CLONE_NEWUSER) followed by TIPC generic-netlink GENL_ID_CTRL lookups and bearer-enable operations
Monitor dmesg and /var/log/kern.log for list debug BUG traces originating from __list_del_entry_valid_or_report
Alert on unexpected modprobe tipc events from non-administrative processes

Monitoring Recommendations

Ingest kernel logs into a centralized log platform and alert on list_del corruption and kernel BUG strings
Track process lineage for workloads that call unshare and open AF_TIPC sockets
Baseline expected TIPC usage per host and flag deviations from that baseline

How to Mitigate CVE-2026-68323

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits d70c81001df9 and 350e592ff4e3 as soon as vendor builds are available
Blacklist the tipc kernel module on systems that do not require TIPC connectivity
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where policy allows

Patch Information

The fix adds a spinlock_t to struct udp_bearer and takes it around the list_add_rcu() in tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer(). Duplicate peers are rejected under the same lock before allocation, and tipc_udp_is_known_peer() is removed. The bearer is marked disabled under rcast_lock once the list is emptied, so further additions are refused. See the kernel.org commit.

Workarounds

Prevent tipc module autoload by adding install tipc /bin/true to /etc/modprobe.d/tipc-blacklist.conf
Disable unprivileged user namespaces via sysctl on affected hosts
Restrict access to TIPC netlink operations through SELinux or AppArmor policies where feasible

bash

# Configuration example
echo 'install tipc /bin/true' | sudo tee /etc/modprobe.d/tipc-blacklist.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee -a /etc/sysctl.d/99-hardening.conf