CVE-2026-99246

What it actually does

Use-after-free in the TIPC subsystem when the tipc_node_reset_links trace event calls tipc_node_dump() without holding the node lock, allowing a concurrent bearer teardown to free a link structure that is later dereferenced in tipc_link_dump().

Why it matters to the business

Remote attackers can trigger kernel crashes or memory corruption on systems running TIPC over UDP, leading to denial of service or potential code execution; the issue affects any kernel with TIPC enabled and has been public for one day with no known exploits yet.

How an attack unfolds

An attacker sends crafted TIPC UDP packets that reach tipc_rcv and trigger the tipc_node_reset_links trace event; while the dump callback walks link pointers without the node write lock, a parallel bearer disable frees the link, resulting in the subsequent tipc_link_dump dereferencing a freed slab object.

How to fix it

Upgrade to a kernel containing the fix that acquires the node write lock around the trace event; rebuild and reboot affected systems, or apply the backported patch if a distribution update is unavailable.

How to confirm the fix worked

Confirm the patch is present by checking that tipc_node_reset_links now holds tipc_node_write_lock before calling tipc_node_dump; recompile with KASAN and exercise the trace event under concurrent bearer disable to verify absence of use-after-free reports.

Typical attack path

1. Send TIPC discovery or data packets over UDP to a listening node to populate links
2. Trigger the tipc_node_reset_links tracepoint under concurrent link teardown conditions
3. Race the trace dump against tipc_node_link_down so that kfree occurs before tipc_link_dump reads the structure
4. Leverage the resulting slab-use-after-free for memory corruption or kernel panic

How to detect it

Search kernel logs and dmesg for KASAN reports containing tipc_link_dump, tipc_node_dump, or slab-use-after-free during tipc_rcv or tipc_udp_recv; inspect auditd or system call traces for unusual TIPC socket activity coinciding with bearer disable events.

• BUG: KASAN: slab-use-after-free in tipc_link_dump
• tipc_link_dump+0x10cb
• tipc_node_reset_links
• tipc_udp_recv

What your security team should do

• Apply the upstream fix or distribution kernel update within the next maintenance window
• Disable TIPC protocol (net.tipc.enable=0) on systems that do not require it until patched
• Monitor for KASAN or slab-use-after-free reports mentioning tipc_link_dump in kernel logs
• Review network exposure of TIPC UDP ports (default 6118) and apply firewall rules if feasible