Linux Kernel up to 7.1.4 TIPC tipc_exit_net wq_count infinite loop

Summaryinfo

A vulnerability categorized as problematic has been discovered in Linux Kernel up to 7.1.4. This vulnerability affects the function tipc_exit_net of the component TIPC. Such manipulation of the argument wq_count leads to infinite loop. This vulnerability is referenced as CVE-2026-80866. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.4. It has been rated as problematic. Affected by this issue is the function tipc_exit_net of the component TIPC. The manipulation of the argument wq_count with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipc_exit_net() Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete: while (atomic_read(&tn->wq_count)) cond_resched(); This loop can busy-wait for a long time if cond_resched() is a NOP. This typically happens if the netns exit is executed by a high priority task, or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In such cases, it wastes CPU cycles and can lead to soft lockups. Fix this by replacing the busy loop with wait_var_event(), allowing the thread to sleep properly until the work queue count reaches zero. Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and wake_up_var() to wake up the waiter when the count drops to zero. This uses the global wait queue hash table, avoiding the need to bloat struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test() provides the necessary memory barrier to ensure the wakeup is not missed.

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-80866 since 08/26/2026. The exploitation is known to be easy. Local access is required to approach this attack. The exploitation requires an enhanced level of successful authentication. Technical details are known, but there is no available exploit.

Upgrading to version 7.1.5 eliminates this vulnerability. Applying the patch 522d1d950b9e3b68190a6de7534827c8dccedb73 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion