CVE-2026-64543 - Vulnerability Details

- tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
but tipc_disc_rcv() still dereferences b->disc in RX softirq under
rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).

L2 bearers are safe thanks to the synchronize_net() in
tipc_disable_l2_media(), but the UDP bearer defers that call to the
cleanup_bearer() workqueue, so the discoverer is freed with no grace
period:

BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)
Read of size 8 at addr ffff88802348b728 by task poc_tipc/184
<IRQ>
tipc_disc_rcv (net/tipc/discover.c:149)
tipc_rcv (net/tipc/node.c:2126)
tipc_udp_recv (net/tipc/udp_media.c:391)
udp_rcv (net/ipv4/udp.c:2643)
ip_local_deliver_finish (net/ipv4/ip_input.c:241)
</IRQ>
Freed by task 181:
kfree (mm/slub.c:6565)
bearer_disable (net/tipc/bearer.c:418)
tipc_nl_bearer_disable (net/tipc/bearer.c:1001)

The bearer is freed with kfree_rcu(); free the discoverer the same way.
Add an rcu_head to struct tipc_discoverer and free it and its skb from an
RCU callback.

Because the RCU callback (tipc_disc_free_rcu) lives in module text, a
call_rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu_barrier() to tipc_exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.

Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC
and CONFIG_TIPC_MEDIA_UDP.

Published: 2026-07-27

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux TIPC subsystem contains a use‑after‑free flaw when a bearer is disabled while a receive handler still dereferences the discoverer structure. This vulnerability, identified as CWE-825, can corrupt kernel memory and, if exploited, allow an attacker to execute code with kernel privileges. The flaw is triggered during packet reception of the TIPC UDP bearer. Affected systems include any Linux kernel built with TIPC support enabled via CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The vulnerability can be reached from an unprivileged user namespace because the TIPCv2 generic netlink family is namespace‑ok and bearer commands lack GENL_ADMIN_PERM, giving local access to exploit attempts. The CVSS score is 7.8 and the EPSS score is below 1 %, indicating a low to moderate likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require the attacker to generate crafted TIPC UDP packets from within a user namespace, a scenario that is feasible for a local or compromised user with access to the system’s networking stack.

Affected Systems

Affected systems include any Linux kernel built with TIPC support enabled via CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The vulnerability can be reached from an unprivileged user namespace because the TIPCv2 generic netlink family is namespace‑ok and bearer commands lack GENL_ADMIN_PERM, giving local access to exploit attempts.

Risk and Exploitability

The CVSS score is 7.8 and the EPSS score is below 1 %, indicating a low to moderate likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require the attacker to generate crafted TIPC UDP packets from within a user namespace, a scenario that is feasible for a local or compromised user with access to the system’s networking stack.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`25b0b9c4e835ffaa65b61c3efe2e28acf84d0259`	affected	< 5e215bf1c47fdddf8203a0fe80a0ed594065f101
`25b0b9c4e835ffaa65b61c3efe2e28acf84d0259`	affected	< ec7d54d8cc1723921d671e3272b427c96366506f
`25b0b9c4e835ffaa65b61c3efe2e28acf84d0259`	affected	< a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2
`25b0b9c4e835ffaa65b61c3efe2e28acf84d0259`	affected	< b65289e1c3f352a9f92c6e19713ddd647e033253
`25b0b9c4e835ffaa65b61c3efe2e28acf84d0259`	affected	< 1579342d71133da7f00daa02c75cebec7372097b

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,5e215bf1c47fdddf8203a0fe80a0ed594065f101)`	affected	code_commit	—
`[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,ec7d54d8cc1723921d671e3272b427c96366506f)`	affected	code_commit	—
`[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2)`	affected	code_commit	—
`[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,b65289e1c3f352a9f92c6e19713ddd647e033253)`	affected	code_commit	—
`[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,1579342d71133da7f00daa02c75cebec7372097b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel update that incorporates the RCU‑based fix for tipc_disc_rcv
If a patch is unavailable, disable or unload the TIPC UDP bearer module (or the entire TIPC subsystem) to eliminate the use‑after‑free condition
Restrict unprivileged user namespaces from accessing the TIPCv2 genl family, such as by denying bearer commands or applying namespace restrictions

Generated by OpenCVE AI on August 3, 2026 at 16:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00125.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b
https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101
https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2
https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253
https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f
https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64543-1934@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64543
https://www.cve.org/CVERecord?id=CVE-2026-64543

History

Thu, 30 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64543-1934@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64543 https://www.cve.org/CVERecord?id=CVE-2026-64543
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 <IRQ> tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) </IRQ> Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP.
Title		tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101 https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2 https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253 https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T20:10:35.565Z

Updated: 2026-08-05T12:42:50.642Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64543

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-27T21:17:06.850

Modified: 2026-07-30T06:25:58.083

Link: CVE-2026-64543

Redhat

Severity : Moderate

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64543 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T16:45:03Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object