CVE-2026-68323

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the TIPC UDP bearer replicast list updates. The functions tipc udp rcast add() and cleanup bearer() both update the ub->rcast.list using list add rcu() and list del rcu() without proper serialization. Because tipc udp rcast add() runs from the encap receive softirq without rtnl lock(), it can race with the cleanup process, leading to list corruption and a kernel BUG. Additionally, the bearer can be enabled from an unprivileged user namespace because the TIPCv2 generic-netlink operations lack GENL ADMIN PERM. A secondary issue exists where two softirqs discovering the same peer may both add it twice due to a racy lockless pre-check in tipc udp rcast disc(). Furthermore, peers added via tipc udp rcast add() after cleanup bearer() has emptied the list can result in memory leaks when the bearer is freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.