Description
In the Linux kernel, the following vulnerability has been resolved:

tipc: avoid busy looping in tipc_exit_net()

Blamed commit introduced a busy-wait loop in tipc_exit_net()
to wait for pending UDP bearer cleanup works to complete:

while (atomic_read(&tn->wq_count))
cond_resched();

This loop can busy-wait for a long time if cond_resched() is a NOP. This
typically happens if the netns exit is executed by a high priority task,
or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In
such cases, it wastes CPU cycles and can lead to soft lockups.

Fix this by replacing the busy loop with wait_var_event(), allowing the
thread to sleep properly until the work queue count reaches zero.

Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and
wake_up_var() to wake up the waiter when the count drops to zero.

This uses the global wait queue hash table, avoiding the need to bloat
struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test()
provides the necessary memory barrier to ensure the wakeup is not missed.
Published: 2026-09-04
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via kernel soft lockups
Action: Apply Patch
AI Analysis

Impact

The Linux kernel contains a busy‑wait loop in tipc_exit_net() that waits for a work‑queue counter to reach zero. If cond_resched() does nothing, the loop can spin for an extended period, draining CPU cycles and leading to soft lockups. The vulnerability is triggered when a network namespace is torn down in a high‑priority context or when preemption is disabled, because the worker thread cannot be pre‑empted and the loop never yields.

Affected Systems

The flaw affects all Linux kernel builds that include the TIPC stack prior to the patch that replaces the busy loop with a proper wait queue. No specific kernel version range is listed, so any kernel using tipc before the commit that adds wait_var_event() is potentially impacted.

Risk and Exploitability

No EPSS score or KEV listing is available, and a CVSS score is not supplied, but the flaw can be used by an attacker who can cause network namespace teardown in a privileged context. When an attacker induces the tear‑down of a network namespace, the kernel can be forced into a high‑CPU state and may suffer soft lockups, disrupting system availability. Because the issue occurs only when conditional scheduling is bypassed, exploitation requires specific circumstances, making the risk moderate to high for affected systems.

Generated by OpenCVE AI on September 4, 2026 at 19:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel commit that replaces the busy loop with wait_var_event() and updates cleanup_bearer() to use atomic_dec_and_test() and wake_up_var().
  • Enable kernel preemption (CONFIG_PREEMPT=y) or avoid running high‑priority tasks that tear down network namespaces to reduce the chance of the busy loop executing.
  • Monitor kernel CPU usage and detect soft lockups; if lockups occur, consider rebooting or adjusting network namespace management to prevent the trigger.

Generated by OpenCVE AI on September 4, 2026 at 19:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-408

Fri, 04 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipc_exit_net() Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete: while (atomic_read(&tn->wq_count)) cond_resched(); This loop can busy-wait for a long time if cond_resched() is a NOP. This typically happens if the netns exit is executed by a high priority task, or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In such cases, it wastes CPU cycles and can lead to soft lockups. Fix this by replacing the busy loop with wait_var_event(), allowing the thread to sleep properly until the work queue count reaches zero. Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and wake_up_var() to wake up the waiter when the count drops to zero. This uses the global wait queue hash table, avoiding the need to bloat struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test() provides the necessary memory barrier to ensure the wakeup is not missed.
Title tipc: avoid busy looping in tipc_exit_net()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-04T16:48:11.682Z

Reserved: 2026-08-26T14:34:25.798Z

Link: CVE-2026-80866

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T17:16:58.390

Modified: 2026-09-04T17:16:58.390

Link: CVE-2026-80866

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T23:30:06Z

Weaknesses
  • CWE-408

    Incorrect Behavior Order: Early Amplification