Skip to main content

Linux Kernel EUVDEUVD-2026-55424

| CVE-2026-68323 HIGH
Race Condition (CWE-362)
2026-08-10 Linux GHSA-fwrg-j278-r47c
Information Disclosure Linux Race Condition
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local shell in unprivileged user namespace
  2. Delivery
    Load TIPC module and configure UDP bearer
  3. Exploit
    Send crafted peer-discovery UDP packets (softirq path)
  4. Install
    Race concurrent bearer cleanup (workqueue)
  5. C2
    Corrupt rcast doubly-linked list
  6. Execute
    Trigger kernel BUG/memory corruption
  7. Impact
    Escalate to kernel-level code execution

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

TIPC kernel module must be loaded and a UDP bearer must be active or configurable on the target system. Critically, TIPCv2 generic-netlink operations carry no GENL_ADMIN_PERM, so a user with access to a user namespace (the default in many Linux distributions) can configure TIPC bearers without requiring root. The race requires concurrent execution of the UDP encap receive softirq (tipc_udp_rcast_disc()) and the bearer cleanup workqueue (cleanup_bearer()), which an attacker can influence by timing peer discovery traffic against bearer disable operations. Limiting conditions: TIPC is not loaded by default in most Linux distributions; if user namespace creation is restricted (kernel.unprivileged_userns_clone=0), the privilege requirement rises to a more meaningful level. Physical or shell-level local access to the target system is required - this is not remotely triggerable.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, reflecting local access with low privileges and full kernel impact. The AC:L rating from NVD is questionable - the vulnerability is a timing-dependent race between a softirq and a workqueue, which in practice introduces execution-timing complexity typically mapped to AC:H; this analysis assesses AC:H as more accurate. EPSS at 0.15% (5th percentile) corroborates that exploitation in the wild is not expected at scale. This CVE is not listed in CISA KEV and no public exploit code has been identified. The effective privilege bar is lower than PR:L alone suggests, because TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM, allowing the trigger path from an unprivileged user namespace - a meaningful escalation of reachability. However, TIPC is a niche networking protocol not loaded by default in most Linux distributions, significantly constraining the real-world attack surface. Net assessment: genuine local privilege escalation concern for environments running TIPC, but not a broad emergency given low prevalence and very low EPSS.
Exploit ScenarioDerived

A local attacker with access to an unprivileged user namespace creates a TIPC UDP bearer, then drives concurrent peer discovery packets (populating tipc_udp_rcast_disc() from the softirq path) while simultaneously triggering bearer teardown (cleanup_bearer() on the workqueue). The race corrupts the rcast doubly-linked list, triggering a kernel BUG() at lib/list_debug.c:62 that can be leveraged as a kernel memory corruption primitive for privilege escalation. No public proof-of-concept is known at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Race condition in the Linux kernel's TIPC UDP bearer implementation allows a local low-privileged attacker to corrupt an RCU-protected peer list, triggering a kernel BUG and enabling potential privilege escalation to full system compromise. The flaw exists in the TIPC subsystem where tipc_udp_rcast_add() (running from a softirq) and cleanup_bearer() (running from a workqueue) both mutate ub->rcast.list without synchronization, and critically, TIPCv2 generic-netlink ops lack GENL_ADMIN_PERM, allowing the race to be triggered from an unprivileged user namespace. No public exploit is identified at time of analysis, and EPSS probability is very low at 0.15% (5th percentile).

RemediationAI

Apply the upstream kernel fix commits from the stable tree: https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c and https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896. EUVD data reports patched releases at kernel versions 7.1.6 and 7.2-rc5; verify these against your distribution's kernel update channel. Distributions packaging these stable fixes (Red Hat, Ubuntu, SUSE, Debian) should be consulted for their specific update packages. As an immediate workaround where TIPC is not operationally required, unload or blacklist the tipc kernel module (modprobe -r tipc; echo 'blacklist tipc' >> /etc/modprobe.d/blacklist.conf) - this eliminates the attack surface entirely with no impact on non-TIPC workloads. If TIPC is required, restrict access to user namespaces via kernel.unprivileged_userns_clone=0 or equivalent sysctl to raise the privilege bar, noting this may affect container runtimes.

Affected VersionsENISA

Linux ef20cd4dd1633987bcf46ac34ace2c8af212361f <350e592ff4e30e48ffb55e142d11a73e63f4869c
Linux patch: 0
Linux 4.9
Linux ef20cd4dd1633987bcf46ac34ace2c8af212361f <d70c81001df9320d3445e664428a1d408b5ba896
Linux patch: 7.1.6
Linux patch: 7.2-rc5

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The TIPC (Transparent Inter-Process Communication) protocol's UDP media layer maintains a replication-cast peer list (ub->rcast.list) protected via Linux RCU (Read-Copy-Update). RCU protects concurrent readers from writers but does NOT serialize concurrent writers against each other. The vulnerability arises because tipc_udp_rcast_add() (called from tipc_udp_rcast_disc() in the softirq receive path) and cleanup_bearer() (dispatched to a kernel workqueue by tipc_udp_disable()) both invoke list_add_rcu()/list_del_rcu() without holding any lock. When both execute concurrently, the doubly-linked list's prev/next pointers become inconsistent, which the kernel's list_debug integrity checks detect and panic on (BUG at lib/list_debug.c:62). A secondary race allows two softirqs discovering the same peer simultaneously to both pass the duplicate-check and add the same peer twice. A third variant allows a peer to be added after cleanup_bearer() has already emptied the list, leaking that allocation when the bearer is freed. The root cause is a missing mutual exclusion primitive - fixed by introducing a spinlock (rcast_lock) in struct udp_bearer. CPE data confirms the affected product is cpe:2.3:a:linux:linux across multiple version ranges.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Race condition requires precise concurrent softirq/workqueue timing, warranting AC:H; PR:L reflects low-privilege user namespace access confirmed by missing GENL_ADMIN_PERM.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tipc: serialize udp bearer replicast list updates

tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with list_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs from the encap receive softirq (via tipc_udp_rcast_disc()) without rtnl_lock(), so it can race the cleanup delete and corrupt the list:

list_del corruption. prev->next should be ffff8880298d7ab8, but was ffff88802449ad38. (prev=ffff888027e3ec98) kernel BUG at lib/list_debug.c:62! RIP: __list_del_entry_valid_or_report+0x17a/0x200 Workqueue: events cleanup_bearer Call Trace: cleanup_bearer (net/tipc/udp_media.c:811) process_one_work (kernel/workqueue.c:3302) worker_thread (kernel/workqueue.c:3466)

The bearer can be enabled from an unprivileged user namespace, as the TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.

Add a spinlock to struct udp_bearer and take it around the list_add_rcu() in tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so the two writers can no longer corrupt the list.

Reject a duplicate peer under the same lock before allocating, and remove tipc_udp_is_known_peer(). The old lockless pre-check in tipc_udp_rcast_disc() was racy: two softirqs discovering the same peer could both find it absent and add it twice.

cleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the bearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add() and add a peer after cleanup_bearer() has already emptied the list, leaking that entry when the bearer is freed. Mark the bearer disabled under rcast_lock once the list is emptied and refuse further additions.

Executive ViewAI

Why It Matters

A race condition in the Linux kernel's TIPC subsystem (CVE-2026-68323, CVSS 7.8) enables local attackers to escalate privileges and potentially achieve full system compromise. No public exploit identified at time of analysis, though the vulnerability's potential impact remains severe. Organizations operating Linux infrastructure-particularly cloud and containerized environments-must patch immediately to prevent unauthorized administrative access.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Low
niche kernel protocol, not loaded by default in most distros
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-68323 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 ADVISORY https://vuldb.com/vuln/387696 REF https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c REF https://git.kernel.org/stable/c/3ff143a884a19bfcf3aebd999b02274fe44f46f3 REF https://git.kernel.org/stable/c/3ff6b534d20824cddab99c81ea3bd1144e635626 REF https://git.kernel.org/stable/c/5d3cea7d41dc72073fea6f879815c9b57c3b330d REF https://git.kernel.org/stable/c/c148aec60ef1e806cbc9da44b3d89409df998ade REF https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy