CVE-2026-74686: Linux Kernel Race Condition Vulnerability

CVE-2026-74686 Overview

CVE-2026-74686 is a Linux kernel vulnerability in the rqspinlock (resilient queued spinlock) implementation. The issue involves incorrect handling of the waiter queue when a deadlock is detected. When the kernel suppressed queue destruction on deadlock detection, it failed to reset the queue tail, which could leave a CPU waiting indefinitely for a next waiter that never arrives. This condition can produce intermittent stalls and, in the theoretical worst case, an indefinite stall in the locking path. The flaw was resolved upstream through commits to the stable kernel tree.

Critical Impact
The defect can trigger intermittent or indefinite stalls on CPUs waiting in the rqspinlock queue after an ABBA deadlock is detected, degrading kernel responsiveness.

Affected Products

Linux kernel versions incorporating the rqspinlock implementation prior to the fix
Distributions shipping the affected upstream kernel commits
Systems relying on BPF and resilient queued spinlock code paths

Discovery Timeline

2026-08-22 - CVE-2026-74686 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74686

Vulnerability Analysis

The rqspinlock mechanism supports deadlock detection for both AA (same CPU re-entry) and ABBA (cross-CPU cyclic) lock acquisition patterns. When a deadlock is detected, the kernel intentionally preserves the waiter queue rather than flushing it, allowing other waiters to continue attempting acquisition. However, the deadlock-handling path did not follow the same tail-reset logic used by the waitq_timeout label.

Without the tail reset, the detecting CPU waits for the next waiter in the queue to populate node->next so it can propagate an unlock signal. If the detecting CPU is the final waiter, no successor arrives, and the CPU sits idle waiting on a pointer that will never be written. Any subsequent arriving waiter unblocks the path, but until then the CPU stalls.

Root Cause

The root cause is a missing queue-tail reset in the deadlock branch preceding the waitq_timeout label. The timeout branch already handled this correctly by either resetting the tail or, if the tail could not be reset, signaling the next waiter with RES_TIMEOUT_VAL. The deadlock branch omitted equivalent logic and instead unconditionally waited for a successor node, creating a race where the last waiter has no one to hand off to. This is a synchronization defect in kernel locking primitives rather than a memory-safety bug.

Attack Vector

No remote or unauthenticated attack vector has been published for this issue. Exploitation would require a workload that induces ABBA deadlock patterns against rqspinlock while the affected CPU becomes the final queue waiter. The concrete sequence described upstream is: CPU 0 holds lock A; CPU 1 holds lock B; CPU 2 becomes pending waiter for B; CPU 0 queues for B; CPU 1 attempts A; CPU 0 detects the ABBA cycle and stalls awaiting a successor. The observable effect is degraded availability rather than code execution or privilege escalation.

See the upstream fixes for technical details: Kernel Git Commit 7a3c028 and Kernel Git Commit f54667b.

Detection Methods for CVE-2026-74686

Indicators of Compromise

Soft lockup or RCU stall messages in dmesg referencing rqspinlock or queued spinlock slow paths
Unexplained CPU pauses correlated with heavy BPF program execution using resilient spinlocks
Kernel task hangs where a CPU appears blocked waiting on node->next in the MCS queue

Detection Strategies

Compare running kernel versions against the fixed commits 7a3c0289 and f54667b0 to identify unpatched hosts
Monitor kernel logs for hung_task, soft lockup warnings, and lock contention traces originating in kernel/bpf/rqspinlock.c
Correlate stall events with workloads that exercise BPF map operations under contention

Monitoring Recommendations

Ingest kernel dmesg and journald telemetry into a centralized log platform for hang and lockup pattern matching
Track host uptime, scheduler latency, and per-CPU stall counters across the Linux fleet
Alert on repeated rcu_sched or watchdog warnings that coincide with BPF workload spikes

How to Mitigate CVE-2026-74686

Immediate Actions Required

Inventory Linux hosts running kernels that include rqspinlock and cross-reference against the fixed commits
Prioritize patching of systems that run untrusted or high-contention BPF workloads
Subscribe to distribution security advisories to receive backported kernel updates as they are released

Patch Information

The fix adjusts the deadlock branch to reset the queue tail and, when reset is not possible, signal the next waiter appropriately so the queue can drain without stalling. Apply the upstream patches referenced by Kernel Git Commit 7a3c028 and Kernel Git Commit f54667b, or install the equivalent vendor-provided kernel package once available.

Workarounds

Reduce reliance on BPF programs that exercise rqspinlock under heavy contention until patched kernels are deployed
Configure kernel watchdogs and hung_task_timeout_secs to surface stalls quickly for operator intervention
Schedule staged reboots after applying updated kernel packages to ensure the fix is loaded

bash

# Verify kernel version and check for the fixed commits after updating
uname -r
rpm -q kernel   # RHEL/CentOS/Fedora
dpkg -l | grep linux-image   # Debian/Ubuntu