tipc: avoid busy looping in tipc_exit_net() (Linux Linux)

CVE-2026-80866
Not available

At a glance

Source
NVD
EPSS
EPSS 0.21 % · percentile 11 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipc_exit_net() Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete: while (atomic_read(&tn->wq_count)) cond_resched(); This loop can busy-wait for a long time if cond_resched() is a NOP. This typically happens if the netns exit is executed by a high priority task, or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In such cases, it wastes CPU cycles and can lead to soft lockups. Fix this by replacing the busy loop with wait_var_event(), allowing the thread to sleep properly until the work queue count reaches zero. Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and wake_up_var() to wake up the waiter when the count drops to zero. This uses the global wait queue hash table, avoiding the need to bloat struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test() provides the necessary memory barrier to ensure the wakeup is not missed.

References

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 772769859226a5b004442403510acb58a1c32e72 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 99b82c8452887408ea908fdfa5df33c4a5dfa88f ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 110bb16d37bdba03213156c0df37e7119c190936 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 7672973957e3e20780afe5937a9fec70b72bc060 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 522d1d950b9e3b68190a6de7534827c8dccedb73 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < c1481c94e74c955e0448ddf46b8615a44d840c1e
Linux · Linuxaffected 5.13 ; unaffected 0 < 5.13 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.57 ≤ 6.18.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD