CVE-2026-74609 - Vulnerability Details

- tipc: read le->link under the node lock in tipc_node_link_down()

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: read le->link under the node lock in tipc_node_link_down()

tipc_node_link_down() caches the link pointer before taking n->lock:

struct tipc_link *l = le->link; /* unlocked */

if (!l)
return;
tipc_node_write_lock(n);
if (!tipc_link_is_establishing(l)) { /* deref l */
...
tipc_link_reset(l); /* write into l */
if (delete) {
kfree(l);
le->link = NULL;

The delete=true caller frees that very object under n->lock, so the lock
does not protect the cached pointer against it:

- CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link
supervision timer via tipc_node_timeout(), reads l unlocked and then
dereferences it under n->lock;
- CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -> bearer_disable()
-> tipc_node_delete_links() -> tipc_node_link_down(n, bearer_id, true)
-> kfree(l).

The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers
disable_media() only schedules the asynchronous cleanup_bearer() work, so
its synchronize_net() runs after the links are already gone. An in-flight
CPU A that has read l therefore dereferences freed memory once B frees it:
a use-after-free read in tipc_link_is_establishing(), and a use-after-free
write via tipc_link_reset() on the establishing branch.

The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:

BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)
Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0
tipc_link_is_establishing (net/tipc/link.c:285)
tipc_node_link_down (net/tipc/node.c:1076)
tipc_node_timeout (net/tipc/node.c:843)
Allocated by task 9549:
tipc_link_create (net/tipc/link.c:490)
tipc_node_check_dest (net/tipc/node.c:1279)
tipc_disc_rcv (net/tipc/discover.c:252)
tipc_udp_recv (net/tipc/udp_media.c:389)
Freed by task 9549:
tipc_node_link_down (net/tipc/node.c:1084)
tipc_node_delete_links (net/tipc/node.c:1320)
bearer_disable (net/tipc/bearer.c:414)
__tipc_nl_bearer_disable (net/tipc/bearer.c:992)

Move the le->link read inside tipc_node_write_lock(), so it is serialised
against the kfree() in the delete path. A racing teardown now either has
not run yet, and we see a valid link, or has already run, and we see NULL.

Published: 2026-08-22

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs in the Linux kernel’s TIPC subsystem when a link pointer is cached without holding the node lock and later freed by another thread that also holds the lock. This race condition results in a use‑after‑free, where the freed memory is subsequently read and written, potentially corrupting kernel memory. If exploited, an attacker could trigger a kernel crash or, depending on surrounding code, arbitrary code execution. The flaw is a classic heap use‑after‑free and is therefore a high‑severity memory corruption issue.

Affected Systems

All Linux kernel builds that contain the TIPC networking stack are potentially affected until the patch that moved the le->link read inside the write lock is applied. No specific version range is listed; the bug existed in at least the 7.2.0 RC kernel and earlier stable releases that have not yet incorporated the commit adding the lock guard.

Risk and Exploitability

The lack of a published CVSS score and the absence of EPSS data make the quantitative risk difficult to gauge, but the use‑after‑free nature indicates that local privileged code could harness kernel memory corruption. The bug is not currently listed in CISA KEV and no public exploits are known. The likely attack vector requires a user who can influence TIPC traffic or invoke netlink bearer disable operations, such as a local attacker with network privileges or someone controlling TIPC traffic.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< 2be741ad565c610871a6a95062c12c39da7168fd
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< 69d209461c110388710e483a130caf051e4fd09a
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< de017c22135f545ca4e65d1eada22887b64958eb
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< 47ba70891b10b2feb52462086b7fcd2ad75d3ce3
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< a714d62513befef37f71f4ae89bb1fe173b65f2e
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< c3f2347a47754eac690967cfd82cb6d559817b07
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< 5558a8312452ddb21eff22b1cbd84302ad951944
`73f646cec35477b5099d7e952297cb9e1855be45`	affected	< cba9ccb47e9fa4cc77692fb896cc5ab57a667882

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[73f646cec35477b5099d7e952297cb9e1855be45,2be741ad565c610871a6a95062c12c39da7168fd)`	affected	code_commit	—
`[73f646cec35477b5099d7e952297cb9e1855be45,69d209461c110388710e483a130caf051e4fd09a)`	affected	code_commit	—
`[73f646cec35477b5099d7e952297cb9e1855be45,de017c22135f545ca4e65d1eada22887b64958eb)`	affected	code_commit	—
`[73f646cec35477b5099d7e952297cb9e1855be45,47ba70891b10b2feb52462086b7fcd2ad75d3ce3)`	affected	code_commit	—
`[73f646cec35477b5099d7e952297cb9e1855be45,a714d62513befef37f71f4ae89bb1fe173b65f2e)`	affected	code_commit	—
`[73f646cec35477b5099d7e952297cb9e1855be45,c3f2347a47754eac690967cfd82cb6d559817b07)`	affected	code_commit	—
`[73f646cec35477b5099d7e952297cb9e1855be45,5558a8312452ddb21eff22b1cbd84302ad951944)`	affected	code_commit	—
`[73f646cec35477b5099d7e952297cb9e1855be45,cba9ccb47e9fa4cc77692fb896cc5ab57a667882)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.4`	affected	generic	—
`[0,4.4)`	unaffected	generic	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the lock guard commit for tipc_node_link_down()
If an update is not feasible, unload or disable the TIPC module until a fixed kernel is available
Restrict access to TIPC services and netlink TIPC_NL_BEARER_DISABLE by firewalling or disabling unused network interfaces

Generated by OpenCVE AI on August 22, 2026 at 16:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd
https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3
https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944
https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a
https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e
https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07
https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882
https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb

History

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: read le->link under the node lock in tipc_node_link_down() tipc_node_link_down() caches the link pointer before taking n->lock: struct tipc_link l = le->link; / unlocked / if (!l) return; tipc_node_write_lock(n); if (!tipc_link_is_establishing(l)) { / deref l / ... tipc_link_reset(l); / write into l */ if (delete) { kfree(l); le->link = NULL; The delete=true caller frees that very object under n->lock, so the lock does not protect the cached pointer against it: - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link supervision timer via tipc_node_timeout(), reads l unlocked and then dereferences it under n->lock; - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -> bearer_disable() -> tipc_node_delete_links() -> tipc_node_link_down(n, bearer_id, true) -> kfree(l). The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers disable_media() only schedules the asynchronous cleanup_bearer() work, so its synchronize_net() runs after the links are already gone. An in-flight CPU A that has read l therefore dereferences freed memory once B frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch. The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6: BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285) Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0 tipc_link_is_establishing (net/tipc/link.c:285) tipc_node_link_down (net/tipc/node.c:1076) tipc_node_timeout (net/tipc/node.c:843) Allocated by task 9549: tipc_link_create (net/tipc/link.c:490) tipc_node_check_dest (net/tipc/node.c:1279) tipc_disc_rcv (net/tipc/discover.c:252) tipc_udp_recv (net/tipc/udp_media.c:389) Freed by task 9549: tipc_node_link_down (net/tipc/node.c:1084) tipc_node_delete_links (net/tipc/node.c:1320) bearer_disable (net/tipc/bearer.c:414) __tipc_nl_bearer_disable (net/tipc/bearer.c:992) Move the le->link read inside tipc_node_write_lock(), so it is serialised against the kfree() in the delete path. A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.
Title		tipc: read le->link under the node lock in tipc_node_link_down()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3 https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944 https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07 https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882 https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:31:56.054Z

Updated: 2026-08-22T15:31:56.054Z

Reserved: 2026-08-15T05:44:03.920Z

Link: CVE-2026-74609

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:33.407

Modified: 2026-08-22T16:16:33.407

Link: CVE-2026-74609

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-22T19:30:17Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object