CVE-2026-52945

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.15 and 6.1

Description An issue exists in the WireGuard driver where the decryption side can stop working completely for a specific peer under heavy networking load. This occurs when the system is under pressure and the first packet in the peer->rx queue remains in the PACKET STATE UNCRYPTED state while subsequent packets are decrypted out of order. This leads to a state where the wg packet rx poll function is no longer called, and the rx queue reaches its maximum capacity of 1024 packets, causing wg prev queue enqueue to fail. This results in a permanent stall of traffic for that particular peer, affecting newly initiated connections as well. The issue is linked to the default enablement of threaded NAPI (New API), a mechanism used to improve network packet processing by distributing work across multiple CPUs.

Recommendations For Linux kernel versions 5.15 and 6.1, revert the change that enables threaded NAPI by default in the WireGuard device. As a temporary mitigation, restrict the use of WireGuard encryption for high-load traffic until the configuration is reverted.