Linux Kernel: tipc node reset trace dump Use-After-Free via missing node lock
CVE-2026-99246 Published on November 3, 2026
tipc: protect node reset trace dump with node lock
In the Linux kernel, the following vulnerability has been resolved:
tipc: protect node reset trace dump with node lock
The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.
This permits bearer teardown to free a link while the trace callback is
dumping it:
CPU 0 CPU 1
trace_tipc_node_reset_links()
tipc_node_dump()
l = n->links[0].link
tipc_node_write_lock()
kfree(l)
n->links[0].link = NULL
tipc_node_write_unlock()
tipc_link_dump(l)
tipc_link_dump() then dereferences the stale pointer. KASAN reported:
BUG: KASAN: slab-use-after-free in tipc_link_dump
Read of size 4 by task poc/115
Call Trace:
tipc_link_dump+0x10cb/0x16b0
tipc_node_dump+0x4bb/0x740
trace_event_raw_event_tipc_node_class+0x258/0x360
tipc_node_reset_links+0x14d/0x1a0
tipc_rcv+0x13f5/0x3030
tipc_udp_recv+0x4e3/0x670
Allocated by task 0:
tipc_link_create+0x1e1/0x1020
tipc_node_check_dest+0x7d2/0x11a0
tipc_disc_rcv+0xdbf/0x1430
Freed by task 89:
kfree+0x131/0x3c0
tipc_node_link_down+0x267/0x4b0
tipc_node_delete_links+0xec/0x160
bearer_disable+0x107/0x260
Take the node write lock around the trace event. This serializes the
dump against tipc_node_link_down(delete=true), which frees the link
under the same write lock.
Products Associated with CVE-2026-99246
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below c8b72ca0918e95f708f67c8b3e69b05290f2b6d2 is affected.
- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below 6e492cb98ca69cc1145175e23e22e3b84da7f26d is affected.
- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below 7bb6a35bd6d69019539d8782fb590fd2aa8a3236 is affected.
- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below 6abd93d01b0f495f29201925a5ee8e6a583c4044 is affected.
- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below a6101d62ccfa153db8c218ce59362b8e0316fd4f is affected.
- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b is affected.
- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below fa8c78c0e49aa11fae116fd841e41aa8f2d68751 is affected.
- Version eb18a510b5cd4daeb9736ad8db57a9fc49db185b and below dddf197f29ba5e47a476dde82bf542ca2e0d5e5e is affected.
- Version 5.0 is affected.
- Before 5.0 is unaffected.
- Version 5.10.273, <= 5.10.* is unaffected.
- Version 5.15.224, <= 5.15.* is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.59, <= 6.18.* is unaffected.
- Version 7.2.13, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.