CVE-2026-99246

Status: UPDATED  |  Advisory ID: CVE-2026-99246

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

tipc: protect node reset trace dump with node lock

The tipc_node_reset_links trace event asks tipc_node_dump() to walk the

node's link entries. Unlike the other node events that request link data,

this event runs without the node lock.

This permits bearer teardown to free a link while the trace callback is

dumping it:

CPU 0 CPU 1

trace_tipc_node_reset_links()

tipc_node_dump()

l = n->links[0].link

tipc_node_write_lock()

kfree(l)

n->links[0].link = NULL

tipc_node_write_unlock()

tipc_link_dump(l)

tipc_link_dump() then dereferences the stale pointer. KASAN reported:

BUG: KASAN: slab-use-after-free in tipc_link_dump

Read of size 4 by task poc/115

Call Trace:

tipc_link_dump+0x10cb/0x16b0

tipc_node_dump+0x4bb/0x740

trace_event_raw_event_tipc_node_class+0x258/0x360

tipc_node_reset_links+0x14d/0x1a0

tipc_rcv+0x13f5/0x3030

tipc_udp_recv+0x4e3/0x670

Allocated by task 0:

tipc_link_create+0x1e1/0x1020

tipc_node_check_dest+0x7d2/0x11a0

tipc_disc_rcv+0xdbf/0x1430

Freed by task 89:

kfree+0x131/0x3c0

tipc_node_link_down+0x267/0x4b0

tipc_node_delete_links+0xec/0x160

bearer_disable+0x107/0x260

Take the node write lock around the trace event. This serializes the

dump against tipc_node_link_down(delete=true), which frees the link

under the same write lock. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References