268 lines
15 KiB
JSON
268 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-68323",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-30T09:28:09.382Z",
|
|
"datePublished": "2026-08-10T12:02:59.034Z",
|
|
"dateUpdated": "2026-10-30T12:28:23.482Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:28:23.482Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: serialize udp bearer replicast list updates\n\ntipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with\nlist_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:\n\n list_del corruption. prev->next should be ffff8880298d7ab8,\n but was ffff88802449ad38. (prev=ffff888027e3ec98)\n kernel BUG at lib/list_debug.c:62!\n RIP: __list_del_entry_valid_or_report+0x17a/0x200\n Workqueue: events cleanup_bearer\n Call Trace:\n cleanup_bearer (net/tipc/udp_media.c:811)\n process_one_work (kernel/workqueue.c:3302)\n worker_thread (kernel/workqueue.c:3466)\n\nThe bearer can be enabled from an unprivileged user namespace, as the\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.\n\nAdd a spinlock to struct udp_bearer and take it around the list_add_rcu()\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so\nthe two writers can no longer corrupt the list.\n\nReject a duplicate peer under the same lock before allocating, and remove\ntipc_udp_is_known_peer(). The old lockless pre-check in\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer\ncould both find it absent and add it twice.\n\ncleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the\nbearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add()\nand add a peer after cleanup_bearer() has already emptied the list, leaking\nthat entry when the bearer is freed. Mark the bearer disabled under\nrcast_lock once the list is emptied and refuse further additions."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - Exploitation requires the local half of the race — enabling and then disabling a TIPC UDP replicast bearer via generic netlink — even though the second half is driven by UDP packets; a purely remote peer cannot schedule cleanup_bearer(), so local access is needed.\nAC:L - The attacker owns both racers: they flood LINK_CONFIG UDP packets at the bearer port (softirq list_add_rcu) while issuing TIPC_NL_BEARER_DISABLE (workqueue list_del_rcu), and the window is wide because b->up is cleared before cleanup_bearer is scheduled, so it can be retried until it hits.\nPR:L - TIPC_NL_BEARER_ENABLE/DISABLE/ADD use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the net's owning user namespace, which any unprivileged user obtains with unshare -Urn; no real root is required.\nUI:N - The attacker performs every step itself — create netns, enable bearer, send packets, disable bearer — with no action by any other user or administrator.\nS:U - The corruption and any resulting escalation stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Concurrent list_add_rcu/list_del_rcu on ub->rcast.list leaves dangling and duplicated entries, so udp_replicast objects freed by rcast_free_rcu remain reachable from the list; the resulting use-after-free reads of attacker-groomed heap memory can disclose arbitrary kernel data.\nI:H - List corruption makes list_add_rcu/list_del_rcu write prev->next and next->prev through stale pointers into freed or attacker-controlled heap memory, a classic write primitive that is leverageable for control-flow hijack and privilege escalation.\nA:H - The reported symptom is a hard kernel BUG at lib/list_debug.c:62 (__list_del_entry_valid_or_report) in the cleanup_bearer workqueue, i.e. an immediate panic; without CONFIG_DEBUG_LIST the corrupted list and freed-entry traversal crash the kernel anyway."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/tipc/udp_media.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
|
|
"lessThan": "c148aec60ef1e806cbc9da44b3d89409df998ade",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
|
|
"lessThan": "3ff6b534d20824cddab99c81ea3bd1144e635626",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
|
|
"lessThan": "3ff143a884a19bfcf3aebd999b02274fe44f46f3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
|
|
"lessThan": "5d3cea7d41dc72073fea6f879815c9b57c3b330d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
|
|
"lessThan": "d70c81001df9320d3445e664428a1d408b5ba896",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ef20cd4dd1633987bcf46ac34ace2c8af212361f",
|
|
"lessThan": "350e592ff4e30e48ffb55e142d11a73e63f4869c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/tipc/udp_media.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.9",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.114",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.57",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.6",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9",
|
|
"versionEndExcluding": "6.12.114"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9",
|
|
"versionEndExcluding": "6.18.57"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9",
|
|
"versionEndExcluding": "7.1.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c148aec60ef1e806cbc9da44b3d89409df998ade"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3ff6b534d20824cddab99c81ea3bd1144e635626"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3ff143a884a19bfcf3aebd999b02274fe44f46f3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5d3cea7d41dc72073fea6f879815c9b57c3b330d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c"
|
|
}
|
|
],
|
|
"title": "tipc: serialize udp bearer replicast list updates",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-68323",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T15:47:07.182932Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-362",
|
|
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-19T21:09:04.822Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |