CVE-2026-80866: Linux Kernel TIPC DOS Vulnerability

CVE-2026-80866 Overview

CVE-2026-80866 is a Linux kernel vulnerability in the Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in the tipc_exit_net() function, which used a busy-wait loop to synchronize with pending UDP bearer cleanup work. When cond_resched() operates as a no-op, the loop consumes CPU cycles and can trigger soft lockups. The upstream fix replaces the busy loop with wait_var_event() and updates cleanup_bearer() to signal completion through atomic_dec_and_test() and wake_up_var().

Critical Impact
The defect can cause soft lockups and CPU exhaustion during network namespace teardown, degrading host availability on kernels built without preemption or when the exit path runs at high priority.

Affected Products

Linux kernel builds containing the TIPC subsystem
Kernels compiled with CONFIG_PREEMPT_NONE where cond_resched() may not yield
Stable branches prior to the fixes referenced in commits 522d1d95 and c1481c94

Discovery Timeline

2026-09-04 - CVE-2026-80866 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80866

Vulnerability Analysis

The TIPC subsystem provides cluster-wide inter-process communication for the Linux kernel. During network namespace destruction, tipc_exit_net() must wait until all pending UDP bearer cleanup work items complete before proceeding. The prior implementation performed this synchronization with a tight polling loop that read tn->wq_count and called cond_resched() between iterations.

On kernels configured without preemption, cond_resched() becomes a no-op. When the exit path runs under a high-priority task, the loop monopolizes the CPU while waiting for lower-priority cleanup work to finish. This produces soft lockup warnings from the kernel watchdog and wastes CPU cycles that other workloads need.

The issue is a resource exhaustion and denial-of-service condition triggered through legitimate namespace teardown paths, notably container lifecycle operations that create and destroy network namespaces at scale.

Root Cause

The root cause is an incorrect synchronization primitive. Busy-waiting on an atomic counter without a proper sleeping wait mechanism assumes cond_resched() will always yield, which is false under CONFIG_PREEMPT_NONE or elevated task priority. The counter update in cleanup_bearer() did not include a wakeup call because there was no waiter to signal.

Attack Vector

Exploitation does not require network access. Any workload that repeatedly creates and destroys network namespaces containing TIPC UDP bearers can induce the busy-wait condition. Container orchestrators, CI runners, and multi-tenant hosts are the most likely to observe the symptom. The vulnerability manifests as CPU starvation rather than memory corruption or privilege escalation. See the upstream fix in Kernel Git Commit 522d1d9 and the companion change in Kernel Git Commit c1481c9 for the exact code transformation.

Detection Methods for CVE-2026-80866

Indicators of Compromise

Kernel log messages containing soft lockup - CPU#N stuck originating from tipc_exit_net stack frames
Sustained 100% CPU utilization on a single core during network namespace teardown
Elevated nr_running counts on hosts performing frequent container churn with TIPC configured

Detection Strategies

Inspect kernel ring buffer output with dmesg | grep -i 'soft lockup' and correlate stack traces against the TIPC exit path
Enable hardlockup_detector and softlockup_detector sysctl parameters to capture watchdog events
Collect flamegraphs during namespace teardown to identify time spent in tipc_exit_net and cleanup_bearer

Monitoring Recommendations

Track per-CPU utilization and run-queue depth on hosts running container workloads that load the tipc module
Alert on repeated soft lockup entries in /var/log/kern.log or systemd-journald output
Baseline network namespace creation and destruction rates and flag deviations that coincide with CPU saturation

How to Mitigate CVE-2026-80866

Immediate Actions Required

Upgrade to a kernel version that includes the fixes referenced in commits 522d1d95 and c1481c94
On unpatched systems, unload the tipc module with modprobe -r tipc if the protocol is not required
Blacklist the module in /etc/modprobe.d/ on hosts that do not need TIPC to prevent inadvertent loading

Patch Information

The upstream Linux kernel resolves the issue by replacing the busy-wait loop in tipc_exit_net() with wait_var_event(), allowing the calling thread to sleep until tn->wq_count reaches zero. The cleanup_bearer() function now uses atomic_dec_and_test() and wake_up_var() to notify the waiter, with the atomic operation providing the memory barrier that guarantees the wakeup is not missed. Backports are tracked in the stable trees referenced by Kernel Git Commit 522d1d9 and Kernel Git Commit c1481c9.

Workarounds

Enable a preemption model such as CONFIG_PREEMPT or CONFIG_PREEMPT_VOLUNTARY when building kernels to reduce the likelihood that cond_resched() becomes a no-op
Avoid running network namespace teardown from high-priority tasks on hosts with TIPC UDP bearers active
Restrict TIPC bearer configuration to hosts that require the protocol, minimizing exposure of the vulnerable code path

bash

# Configuration example: disable the TIPC module on hosts that do not need it
echo 'blacklist tipc' | sudo tee /etc/modprobe.d/disable-tipc.conf
sudo modprobe -r tipc
lsmod | grep tipc