« Volver al listado

CVE-2026-68438

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

smp: Make CSD lock acquisition atomic for debug mode

Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD lock debugging is enabled, async !wait calls use the destination CPU csd_data. That improves diagnostics, but it also removes the single-writer property that made the old csd_lock() safe: multiple CPUs can now prepare the same destination CPU CSD concurrently.

csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the bit with a non-atomic read-modify-write.

Leer descripción completaMostrar menos

Two senders can both see an unlocked CSD, set the bit, overwrite the callback fields, and enqueue the same llist node. Re-adding a node that is already the queue head can make node->next point to itself, leaving the target CPU stuck walking call_single_queue. Later synchronous work, such as a TLB shootdown, can then remain queued and trigger soft-lockup warnings or panics.

Keep the single csd_lock() implementation, but when CSD lock debugging is enabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the destination CPU CSD a real atomic lock in the only configuration where it can be shared by multiple remote senders, while preserving the existing non-debug fast path.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68438",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b0473dcd4b1d7e2e44947e7ac1820c73a268821a",
              "lessThan": "282d220bae5fbfc90cf0e3d5b5e42c00ad79f989",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b0473dcd4b1d7e2e44947e7ac1820c73a268821a",
              "lessThan": "35551efb155e3b83445a6c3f66cb498d5efc182c",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/smp.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/smp.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-12T00:17:44.013",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/282d220bae5fbfc90cf0e3d5b5e42c00ad79f989",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/35551efb155e3b83445a6c3f66cb498d5efc182c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmp: Make CSD lock acquisition atomic for debug mode\n\nCommit b0473dcd4b1d (\"smp: Improve smp_call_function_single()\nCSD-lock diagnostics\") changed smp_call_function_single() so that,\nwhen CSD lock debugging is enabled, async !wait calls use the\ndestination CPU csd_data. That improves diagnostics, but it also removes\nthe single-writer property that made the old csd_lock() safe: multiple\nCPUs can now prepare the same destination CPU CSD concurrently.\n\ncsd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the\nbit with a non-atomic read-modify-write. Two senders can both see an\nunlocked CSD, set the bit, overwrite the callback fields, and enqueue\nthe same llist node. Re-adding a node that is already the queue head can\nmake node->next point to itself, leaving the target CPU stuck walking\ncall_single_queue. Later synchronous work, such as a TLB shootdown, can\nthen remain queued and trigger soft-lockup warnings or panics.\n\nKeep the single csd_lock() implementation, but when CSD lock debugging is\nenabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the\ndestination CPU CSD a real atomic lock in the only configuration where it\ncan be shared by multiple remote senders, while preserving the existing\nnon-debug fast path."
    }
  ],
  "lastModified": "2026-08-17T06:17:52.890",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}