CVE-2026-68438 smp: Make CSD lock acquisition atomic for debug mode
A race condition in Linux kernel SMP CSD lock acquisition during debug mode can cause system hangs or panics.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68438?
CVE-2026-68438 is a vulnerability in Linux, published on 12 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smp: Make CSD lock acquisition atomic for debug mode
Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD lock debugging is enabled, async !wait calls use the destination CPU csd_data. That improves diagnostics, but it also removes the single-writer property that made the old csd_lock() safe: multiple CPUs can now prepare the same destination CPU CSD concurrently.
csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the bit with a non-atomic read-modify-write. Two senders can both see an unlocked CSD, set the bit, overwrite the callback fields, and enqueue the same llist node. Re-adding a node that is already the queue head can make node->next point to itself, leaving the target CPU stuck walking call_single_queue. Later synchronous work, such as a TLB shootdown, can then remain queued and trigger soft-lockup warnings or panics.
Keep the single csd_lock() implementation, but when CSD lock debugging is enabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the destination CPU CSD a real atomic lock in the only configuration where it can be shared by multiple remote senders, while preserving the existing non-debug fast path.
Which versions are affected by CVE-2026-68438?
How do I fix CVE-2026-68438?
Apply the vendor's patch.
Is CVE-2026-68438 being exploited?
There is no known exploitation of CVE-2026-68438 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-68438, GHSA-26r5-rg9x-853c, UBUNTU-CVE-2026-68438.