CVE-2026-68323

This is a local denial-of-service vulnerability in the TIPC UDP bearer code where a non-privileged user can trigger kernel panic through a list-corruption race. The bug lives in tipc/udp_media.c: two distinct code paths write to the same peer list without mutual exclusion. The workqueue path (cleanup_bearer) and the softirq path (tipc_udp_rcast_add, triggered by incoming UDP packets) can both modify the list simultaneously, and RCU provides zero protection against concurrent writers—it only guarantees safe reads and safe reclamation after readers exit. The trigger vector is what elevates this from a typical race condition to a serious availability risk. The TIPCv2 generic-netlink operations for enabling bearers lack GENL_ADMIN_PERM, meaning an unprivileged user in a user namespace can deterministically enable the bearer, which launches the softirq path that races with cleanup. You're not relying on chance timing to trigger the race—you create the conditions by toggling bearer state. In shared-hosting or container environments, one tenant can panic the kernel and take down unrelated workloads. The patch adds a spinlock plus a disabled flag. The lock handles the concurrent-writer race; the flag handles a temporal problem where cleanup can start while the softirq path is still reachable due to the enable/disable sequence. The flag is worth noting as technical debt—future developers may misunderstand its purpose and introduce new races. What distinguishes this from a theoretical exploit: the corruption leads to kernel BUG/panic, not controlled data overwrite. That's a guaranteed local DoS with no privilege required, which is the actual threat model impact. The CVSS 7.8 captures severity but undersells the systemic risk in multi-tenant environments.

Reviewed through automated stages and approved by a human before publication.