CVE-2026-68334: Linux Kernel Race Condition Vulnerability

CVE-2026-68334 Overview

CVE-2026-68334 is a race condition in the Linux kernel's rxrpc subsystem. The flaw lives in rxrpc_wake_up_io_thread(), which checks local->io_thread for NULL and then reloads the same pointer when calling wake_up_process(). Because the I/O thread clears local->io_thread with WRITE_ONCE() on exit, the second load can observe NULL even when the first load did not. The result is a potential NULL pointer dereference in kernel context when the I/O thread terminates concurrently with a wake-up call. The upstream fix reads the pointer once with READ_ONCE() and reuses that snapshot for both the check and the wake-up, matching the pattern already used in rxrpc_encap_rcv().

Critical Impact
A concurrent teardown of the rxrpc I/O thread can trigger a NULL pointer dereference, leading to kernel-level denial of service on systems using AF_RXRPC sockets.

Affected Products

Linux kernel builds containing the vulnerable rxrpc_wake_up_io_thread() implementation prior to the referenced stable commits
Distributions shipping kernels with AF_RXRPC support compiled in
Systems using AFS or other rxrpc-dependent workloads

Discovery Timeline

2026-08-10 - CVE-2026-68334 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68334

Vulnerability Analysis

The defect is a classic double-load race on a shared pointer. rxrpc_wake_up_io_thread() first evaluates local->io_thread to decide whether the I/O thread exists, and then dereferences local->io_thread again when passing it to wake_up_process(). Between those two accesses, the exiting I/O thread can publish NULL to that field using WRITE_ONCE(). The wake-up path then hands a NULL task_struct * to wake_up_process(), which dereferences it and oopses the kernel.

This is a data race in the concurrency sense and a NULL pointer dereference in the memory-safety sense. The fix takes a single READ_ONCE() snapshot of local->io_thread, tests the local variable for NULL, and only then passes the same value to wake_up_process(). The change aligns the helper with rxrpc_encap_rcv(), which already uses the snapshot pattern.

Root Cause

The root cause is unsynchronized access to a pointer that another thread mutates without a lock. Loading the pointer twice violates the assumption that its value remains stable across the check and the use, a Time-of-Check to Time-of-Use pattern [CWE-367] that resolves into a NULL pointer dereference [CWE-476].

Attack Vector

Exploitation requires the ability to drive rxrpc socket activity and teardown on the affected host. A local process that opens, closes, and exercises AF_RXRPC sockets can race the wake-up path against I/O thread exit. The realistic impact is a kernel crash and denial of service. No public exploit is referenced in the advisory, and no CVSS vector has been assigned in the NVD entry.

The vulnerability manifests in the rxrpc_wake_up_io_thread() helper. See the referenced kernel commits for the exact source change: commit 092b42cf, commit 745fb794, and commit c9165e19.

Detection Methods for CVE-2026-68334

Indicators of Compromise

Kernel oops or panic messages referencing wake_up_process in the call stack originating from rxrpc_wake_up_io_thread
Unexpected reboots or kernel BUG entries in dmesg on hosts running AFS clients, AFS servers, or other rxrpc consumers
Repeated crashes correlated with rxrpc socket creation and teardown workloads

Detection Strategies

Compare running kernel versions against distribution advisories that reference the three upstream stable commits for this fix
Audit /proc/kallsyms and module state for rxrpc presence on hosts that do not require AFS or Kerberos rxrpc traffic
Monitor kernel crash dumps for faulting instructions inside wake_up_process() invoked from rxrpc code paths

Monitoring Recommendations

Ship kern.crit and kern.err syslog facilities to a central log store and alert on rxrpc-tagged oops signatures
Track kernel build identifiers across the fleet and flag hosts still running unpatched rxrpc code
Correlate host reboots with preceding AF_RXRPC activity to surface exploitation attempts or unstable workloads

How to Mitigate CVE-2026-68334

Immediate Actions Required

Apply the vendor kernel update that incorporates the upstream READ_ONCE() snapshot fix in rxrpc_wake_up_io_thread()
Reboot affected hosts after patch installation so the new kernel image takes effect
Restrict local shell access on systems that cannot be patched immediately, as the race requires local rxrpc socket activity

Patch Information

The fix is committed to the upstream Linux stable tree in three referenced commits: 092b42cf3f6013eec43607ecbcad674723649514, 745fb794c3e933c023af9dbb5876a5e16ad2dc71, and c9165e199f56997f2f2deb5d3ec2dfab98dfa288. Consume the fix through the distribution kernel package that backports these changes rather than by cherry-picking manually on production systems.

Workarounds

Disable or blacklist the rxrpc kernel module on hosts that do not need AF_RXRPC or AFS functionality
Remove AF_RXRPC socket access for untrusted local users through seccomp or SELinux policy where feasible
Avoid workloads that repeatedly create and tear down rxrpc endpoints on unpatched kernels

bash

# Blacklist the rxrpc module on hosts that do not require AFS/rxrpc
echo "blacklist rxrpc" | sudo tee /etc/modprobe.d/blacklist-rxrpc.conf
sudo rmmod rxrpc 2>/dev/null || true

# Verify the module is no longer loaded
lsmod | grep rxrpc