In the Linux kernel, a race condition was discovered in the TIPC topology server. Connections were closed while the send and receive workqueues were still running, allowing socket callbacks and subscription events to queue additional work. This race caused refcount misuse, a use‑after‑free in tipc_conn_close(), queue_work() calls on destroyed workqueues, and an RCU stall during shutdown. The result is a kernel crash that could lead to denial of service or privilege escalation if an attacker can influence TIPC traffic.

The vulnerability affects any Linux system running a kernel that implements TIPC without the patch applied. No specific kernel versions are listed in the data, so all kernels that contain the vulnerable TIPC code before the fix are potentially impacted.

The CVSS rating is not provided, and the EPSS score is unavailable, meaning we lack quantified risk metrics. The vulnerability is not listed in the CISA KEV catalog, so no known exploits are reported. Because the flaw resides in the kernel and requires TIPC traffic from an attacker—an exposed network vector—the attack could be delivered remotely to a system exposing TIPC services. In the absence of a public exploit and given the lack of known mitigation from an upstream vendor, the risk is considered significant but the likelihood of exploitation remains uncertain until the kernel is patched.