tipc: avoid busy looping in tipc_exit_net() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 11 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipc_exit_net() Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete: while (atomic_read(&tn->wq_count)) cond_resched(); This loop can busy-wait for a long time if cond_resched() is a NOP. This typically happens if the netns exit is executed by a high priority task, or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In such cases, it wastes CPU cycles and can lead to soft lockups. Fix this by replacing the busy loop with wait_var_event(), allowing the thread to sleep properly until the work queue count reaches zero. Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and wake_up_var() to wake up the waiter when the count drops to zero. This uses the global wait queue hash table, avoiding the need to bloat struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test() provides the necessary memory barrier to ensure the wakeup is not missed.
References
- https://git.kernel.org/stable/c/772769859226a5b004442403510acb58a1c32e72
- https://git.kernel.org/stable/c/99b82c8452887408ea908fdfa5df33c4a5dfa88f
- https://git.kernel.org/stable/c/110bb16d37bdba03213156c0df37e7119c190936
- https://git.kernel.org/stable/c/7672973957e3e20780afe5937a9fec70b72bc060
- https://git.kernel.org/stable/c/522d1d950b9e3b68190a6de7534827c8dccedb73
- https://git.kernel.org/stable/c/c1481c94e74c955e0448ddf46b8615a44d840c1e
European references
- ENISA EUVD · EUVD-2026-71496
- GCVE · GCVE-0-2026-80866
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 772769859226a5b004442403510acb58a1c32e72 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 99b82c8452887408ea908fdfa5df33c4a5dfa88f ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 110bb16d37bdba03213156c0df37e7119c190936 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 7672973957e3e20780afe5937a9fec70b72bc060 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < 522d1d950b9e3b68190a6de7534827c8dccedb73 ; affected 04c26faa51d1e2fe71cf13c45791f5174c37f986 < c1481c94e74c955e0448ddf46b8615a44d840c1e |
| Linux · Linux | affected 5.13 ; unaffected 0 < 5.13 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.57 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |