Cloudanix VulnDB

CVE-2026-80866

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A kernel bug can make the system freeze or waste CPU when shutting down certain network features, potentially disrupting services until fixed by a kernel update.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability introduces a busy-wait loop using atomic_read and cond_resched in tipc_exit_net that fails to yield on non-preemptible kernels or high-priority tasks, consuming CPU and risking soft lockups during UDP bearer cleanup in network namespace teardown.

Why it matters to the business

Systems may experience CPU exhaustion, soft lockups, or kernel hangs during network namespace shutdown or module unload, reducing availability and complicating container or VM teardown in production environments.

How an attack unfolds

An attacker with local access or the ability to trigger repeated network namespace creation and destruction (for example via unprivileged user namespaces or container lifecycle events) can force execution of the buggy exit path under CONFIG_PREEMPT_NONE or high-priority scheduling, causing sustained busy-waiting that leads to soft lockups and denial of service.

How to fix it

Upgrade to a Linux kernel containing the upstream fix that replaces the busy loop with wait_var_event, atomic_dec_and_test, and wake_up_var in the TIPC exit and bearer cleanup paths; apply the patch or the next stable kernel release after 2026-09-04.

How to confirm the fix worked

Confirm the presence of wait_var_event and atomic_dec_and_test calls in tipc_exit_net and cleanup_bearer after the update; verify that no soft lockup warnings referencing tipc_exit_net appear during repeated netns teardown under CONFIG_PREEMPT_NONE.

Typical attack path

  1. Obtain local execution or container management rights on a vulnerable kernel
  2. Repeatedly create and destroy network namespaces that load TIPC UDP bearers
  3. Trigger tipc_exit_net under non-preemptive scheduling or high-priority context
  4. Induce prolonged busy-waiting that manifests as soft lockup warnings or system stalls

How to detect it

Search kernel logs and dmesg for soft lockup or RCU stall messages occurring during netns or module exit that mention tipc_exit_net or wq_count; inspect audit logs for repeated namespace creation and destruction events on systems using TIPC.

  • soft lockup.*tipc_exit_net
  • wq_count.*cond_resched
  • BUG: soft lockup in tipc

What your security team should do

  • Prioritize kernel upgrades on systems running TIPC or container workloads that frequently create network namespaces
  • Enable kernel soft lockup detection and monitor for related warnings
  • Restrict unprivileged user namespace creation where feasible until patched
  • Test namespace teardown performance after applying the fix

The record

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipc_exit_net() Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete: while (atomic_read(&tn->wq_count)) cond_resched(); This loop can busy-wait for a long time if cond_resched() is a NOP. This typically happens if the netns exit is executed by a high priority task, or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In such cases, it wastes CPU cycles and can lead to soft lockups. Fix this by replacing the busy loop with wait_var_event(), allowing the thread to sleep properly until the work queue count reaches zero. Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and wake_up_var() to wake up the waiter when the count drops to zero. This uses the global wait queue hash table, avoiding the need to bloat struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test() provides the necessary memory barrier to ensure the wakeup is not missed.

Affected packages

Ecosystem Package Introduced Fixed