CVE-2026-72299 - Vulnerability Details

- tipc: restrict socket queue dumps in enqueue tracepoints

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: restrict socket queue dumps in enqueue tracepoints

tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is
owned by user context. The spinlock protects the backlog queue in this
path, but it does not serialize against the socket owner consuming or
purging sk_receive_queue.

KASAN reported:

CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123
print_report+0xce/0x5b0 mm/kasan/report.c:482
kasan_report+0xc6/0x100 mm/kasan/report.c:597
__asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380
tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73
tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187
tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996
trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188
tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497
tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689
__tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512
tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400
sock_sendmsg+0x2f6/0x3e0 net/socket.c:825
splice_to_socket+0x7f9/0x1010 fs/splice.c:884
do_splice+0xe21/0x2330 fs/splice.c:936
__do_splice+0x153/0x260 fs/splice.c:1431
__x64_sys_splice+0x150/0x230 fs/splice.c:1616
x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41
do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63
entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130
RIP: 0033:0x71624e8aafe2
Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66
RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2
RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066
RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00
R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40
</TASK>

The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump
sk_receive_queue and can therefore dereference skbs that the socket
owner has already dequeued or freed. Restrict these dumps to
TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held
spinlock.

Keep the change limited to the enqueue path, where the unsafe queue dump
is reachable while the socket is owned by user context.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Internal kernel tracepoints in the TIPC module accidentally dump the socket receive queue while holding a spinlock that does not protect the queue against concurrent consumption. This dereferences memory that may have already been freed, causing a use‑after‑free error as confirmed by KASAN. The resulting memory corruption can abort the kernel, potentially causing a denial of service. The weakness is an improper synchronization exploit.

Affected Systems

Linux kernels that contain the tipc module before the commit referenced in the advisory are affected. This includes all releases of the mainline Linux kernel up to the point where the fix was merged. No specific version ranges are listed, so all susceptible kernels are at risk.

Risk and Exploitability

The CVSS score is 9.8, and the EPSS score is < 1%, indicating a high severity but low exploitation probability. The bug is triggered when a user‑level process initiates a TIPC enqueue operation while the TIPC_DUMP_ALL tracepoint is enabled, typically a privileged debugging capability. The vulnerability is not listed in CISA's KEV catalog, implying no confirmed exploitation reports. Nonetheless, the local nature of the trigger means that an attacker with sufficient local privileges could invoke the vulnerability by enabling the relevant tracepoints and causing the TIPC socket to process queued packets. The likely attack vector is local, requiring the attacker to have access to processes that can enable tracepoints and interact with the tipc module.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< 273ff83c49b82e4267373adbe629e6ee8aeaa16c
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< 258fb15b30db4f3941ab335d5e02f744baf1da54
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< 12876864f9de5fa6f611a30c6c17e405a773bf0a
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< b9e100815f4b55e9ccaf6af9a3aba173eb13d381
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< 61a55fa24a5d737436018764a647fe5b6cb36371
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< 6acbbe54215d5f4251593000cff2bf51d6748713
`01e661ebfbad40e6280fb8ec25f2861d39ba4387`	affected	< acd7df8d955480a6f6e5bb809da67b1500cc3cf4

Linux

affected

Version	Status	Constraints
`5.0`	affected	—
`0`	unaffected	< 5.0
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[01e661ebfbad40e6280fb8ec25f2861d39ba4387,12876864f9de5fa6f611a30c6c17e405a773bf0a)`	affected	code_commit	—
`[01e661ebfbad40e6280fb8ec25f2861d39ba4387,b9e100815f4b55e9ccaf6af9a3aba173eb13d381)`	affected	code_commit	—
`[01e661ebfbad40e6280fb8ec25f2861d39ba4387,61a55fa24a5d737436018764a647fe5b6cb36371)`	affected	code_commit	—
`[01e661ebfbad40e6280fb8ec25f2861d39ba4387,6acbbe54215d5f4251593000cff2bf51d6748713)`	affected	code_commit	—
`[01e661ebfbad40e6280fb8ec25f2861d39ba4387,acd7df8d955480a6f6e5bb809da67b1500cc3cf4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.0`	affected	generic	—
`[0,5.0)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel release that includes the patch that removes the unsafe backlog queue dump from the tipc_sk_enqueue path.
Restrict the TIPC_DUMP_ALL tracepoint to authorized, non‑kernel processes, or disable it entirely when tipc debugging is not required.
If tipc functionality is unnecessary, unload or disable the tipc module to eliminate the attack surface.

Generated by OpenCVE AI on August 22, 2026 at 06:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00745.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/12876864f9de5fa6f611a30c6c17e405a773bf0a
https://git.kernel.org/stable/c/258fb15b30db4f3941ab335d5e02f744baf1da54
https://git.kernel.org/stable/c/273ff83c49b82e4267373adbe629e6ee8aeaa16c
https://git.kernel.org/stable/c/61a55fa24a5d737436018764a647fe5b6cb36371
https://git.kernel.org/stable/c/6acbbe54215d5f4251593000cff2bf51d6748713
https://git.kernel.org/stable/c/acd7df8d955480a6f6e5bb809da67b1500cc3cf4
https://git.kernel.org/stable/c/ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0
https://git.kernel.org/stable/c/b9e100815f4b55e9ccaf6af9a3aba173eb13d381
https://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-72299-a8d3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72299
https://www.cve.org/CVERecord?id=CVE-2026-72299

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/258fb15b30db4f3941ab335d5e02f744baf1da54 https://git.kernel.org/stable/c/273ff83c49b82e4267373adbe629e6ee8aeaa16c https://git.kernel.org/stable/c/ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-72299-a8d3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72299 https://www.cve.org/CVERecord?id=CVE-2026-72299
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-782

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 11:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-782

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize against the socket owner consuming or purging sk_receive_queue. KASAN reported: CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123 print_report+0xce/0x5b0 mm/kasan/report.c:482 kasan_report+0xc6/0x100 mm/kasan/report.c:597 __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380 tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73 tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187 tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996 trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188 tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497 tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689 __tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512 tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400 sock_sendmsg+0x2f6/0x3e0 net/socket.c:825 splice_to_socket+0x7f9/0x1010 fs/splice.c:884 do_splice+0xe21/0x2330 fs/splice.c:936 __do_splice+0x153/0x260 fs/splice.c:1431 __x64_sys_splice+0x150/0x230 fs/splice.c:1616 x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41 do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63 entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130 RIP: 0033:0x71624e8aafe2 Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2 RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066 RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00 R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40 </TASK> The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump sk_receive_queue and can therefore dereference skbs that the socket owner has already dequeued or freed. Restrict these dumps to TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held spinlock. Keep the change limited to the enqueue path, where the unsafe queue dump is reachable while the socket is owned by user context.
Title		tipc: restrict socket queue dumps in enqueue tracepoints
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/12876864f9de5fa6f611a30c6c17e405a773bf0a https://git.kernel.org/stable/c/61a55fa24a5d737436018764a647fe5b6cb36371 https://git.kernel.org/stable/c/6acbbe54215d5f4251593000cff2bf51d6748713 https://git.kernel.org/stable/c/acd7df8d955480a6f6e5bb809da67b1500cc3cf4 https://git.kernel.org/stable/c/b9e100815f4b55e9ccaf6af9a3aba173eb13d381

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:55:19.147Z

Updated: 2026-08-23T12:47:12.393Z

Reserved: 2026-08-09T03:40:39.918Z

Link: CVE-2026-72299

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:02.567

Modified: 2026-08-23T13:16:43.057

Link: CVE-2026-72299

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72299 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T06:30:04Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object