CVE-2026-68323 Affecting kernel-livepatch-6_4_0-150700_53_87-default package, versions <1-150700.15.3.2
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-SLES157-KERNELLIVEPATCH6401507005387DEFAULT-21878136
- published30 Oct 2026
- disclosed29 Oct 2026
Introduced: 29 Oct 2026
NewCVE-2026-68323 (opens in a new tab)How to fix?
Upgrade SLES:15.7 kernel-livepatch-6_4_0-150700_53_87-default to version 1-150700.15.3.2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-6_4_0-150700_53_87-default package and not the kernel-livepatch-6_4_0-150700_53_87-default package as distributed by SLES.
See How to fix? for SLES:15.7 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
tipc: serialize udp bearer replicast list updates
tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with list_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs from the encap receive softirq (via tipc_udp_rcast_disc()) without rtnl_lock(), so it can race the cleanup delete and corrupt the list:
list_del corruption. prev->next should be ffff8880298d7ab8, but was ffff88802449ad38. (prev=ffff888027e3ec98) kernel BUG at lib/list_debug.c:62! RIP: __list_del_entry_valid_or_report+0x17a/0x200 Workqueue: events cleanup_bearer Call Trace: cleanup_bearer (net/tipc/udp_media.c:811) process_one_work (kernel/workqueue.c:3302) worker_thread (kernel/workqueue.c:3466)
The bearer can be enabled from an unprivileged user namespace, as the TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.
Add a spinlock to struct udp_bearer and take it around the list_add_rcu() in tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so the two writers can no longer corrupt the list.
Reject a duplicate peer under the same lock before allocating, and remove tipc_udp_is_known_peer(). The old lockless pre-check in tipc_udp_rcast_disc() was racy: two softirqs discovering the same peer could both find it absent and add it twice.
cleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the bearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add() and add a peer after cleanup_bearer() has already emptied the list, leaking that entry when the bearer is freed. Mark the bearer disabled under rcast_lock once the list is emptied and refuse further additions.
References
- https://www.suse.com/security/cve/CVE-2026-68323.html
- https://bugzilla.suse.com/1274653
- https://git.kernel.org/stable/c/350e592ff4e30e48ffb55e142d11a73e63f4869c
- https://git.kernel.org/stable/c/d70c81001df9320d3445e664428a1d408b5ba896
- https://git.kernel.org/stable/c/5d3cea7d41dc72073fea6f879815c9b57c3b330d
- https://git.kernel.org/stable/c/3ff143a884a19bfcf3aebd999b02274fe44f46f3
- https://git.kernel.org/stable/c/3ff6b534d20824cddab99c81ea3bd1144e635626
- https://git.kernel.org/stable/c/c148aec60ef1e806cbc9da44b3d89409df998ade