Executive brief
The Linux kernel's TIPC protocol implementation contains a busy-wait loop in the network namespace cleanup code that can waste CPU cycles and cause system soft lockups. When high-priority tasks or preemption-disabled kernels exit a network namespace, the kernel repeatedly checks a work queue counter without properly sleeping, consuming CPU resources and potentially degrading system responsiveness.
Technical details
A busy-wait loop in tipc_exit_net() continuously polls an atomic work queue counter using cond_resched(), which may be a no-op on preemption-disabled kernels or when called from high-priority contexts. The vulnerable code path is triggered during network namespace teardown and affects the TIPC (Transparent Inter-Process Communication) subsystem's UDP bearer cleanup. The fix replaces the polling loop with wait_var_event(), which properly puts the thread to sleep, and updates cleanup_bearer() to use atomic_dec_and_test() and wake_up_var() for correct synchronization. The patch is available and has been merged into the Linux kernel stable tree.
Affected products
- Linux Linux Kernel 4.x through 6.x (TIPC-enabled kernels)
Timeline
- 2026-06-23: disclosed
- 2026-06-25: patched
- 2026-09-04: advisory