Executive brief
A flaw in the Linux kernel's WireGuard implementation can cause network traffic to permanently stall between specific servers. This occurs under heavy network load when using certain kernel versions, leading to a situation where encrypted data can no longer be processed for a specific connection. This results in a partial denial of service where affected systems cannot communicate with each other until the issue is manually resolved.
Technical details
A regression was introduced in the Linux kernel when threaded NAPI was enabled by default for WireGuard devices. Under heavy load, a race condition occurs in the packet decryption pipeline: if the first packet in the peer's receive queue (rx_queue) remains in an UNCRYPTED state while subsequent packets are decrypted out-of-order, the NAPI poll routine (wg_packet_rx_poll) may exit early. If the decryption worker for that first packet is delayed, subsequent napi_schedule calls may fail to trigger a new poll. This leads to the rx_queue reaching MAX_QUEUED_PACKETS (1024), at which point no new decryption workers are scheduled, permanently stalling the decryption side for that peer. The fix involves reverting the enablement of threaded NAPI in affected stable kernel branches (v5.15 and v6.1).
Affected products
- Linux Linux Kernel v5.15, v6.1
Timeline
- 2026-02-16: patched: Fix authored by Daniel Borkmann
- 2026-06-24: advisory: CVE-2026-52945 published