CVE-2026-68438 is a vulnerability in Linux Kernel
Published on August 12, 2026
smp: Make CSD lock acquisition atomic for debug mode
In the Linux kernel, the following vulnerability has been resolved:
smp: Make CSD lock acquisition atomic for debug mode
Commit b0473dcd4b1d ("smp: Improve smp_call_function_single()
CSD-lock diagnostics") changed smp_call_function_single() so that,
when CSD lock debugging is enabled, async !wait calls use the
destination CPU csd_data. That improves diagnostics, but it also removes
the single-writer property that made the old csd_lock() safe: multiple
CPUs can now prepare the same destination CPU CSD concurrently.
csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the
bit with a non-atomic read-modify-write. Two senders can both see an
unlocked CSD, set the bit, overwrite the callback fields, and enqueue
the same llist node. Re-adding a node that is already the queue head can
make node->next point to itself, leaving the target CPU stuck walking
call_single_queue. Later synchronous work, such as a TLB shootdown, can
then remain queued and trigger soft-lockup warnings or panics.
Keep the single csd_lock() implementation, but when CSD lock debugging is
enabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the
destination CPU CSD a real atomic lock in the only configuration where it
can be shared by multiple remote senders, while preserving the existing
non-debug fast path.
Products Associated with CVE-2026-68438
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version b0473dcd4b1d7e2e44947e7ac1820c73a268821a and below 282d220bae5fbfc90cf0e3d5b5e42c00ad79f989 is affected.
- Version b0473dcd4b1d7e2e44947e7ac1820c73a268821a and below 35551efb155e3b83445a6c3f66cb498d5efc182c is affected.
- Version 7.1 is affected.
- Before 7.1 is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc5, <= * is unaffected.