tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unpr
CVE-2026-64543
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-64543
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "380413cdfd29fb9fa486c82889132b680c4983c5",
"versionType": "git"
},
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "f05b3f4c78370469286879c765f5a1dd39dbcd32",
"versionType": "git"
},
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "4da2ac7749411971e1b222b992da5a172ce45f98",
"versionType": "git"
},
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "5e215bf1c47fdddf8203a0fe80a0ed594065f101",
"versionType": "git"
},
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "ec7d54d8cc1723921d671e3272b427c96366506f",
"versionType": "git"
},
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2",
"versionType": "git"
},
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "b65289e1c3f352a9f92c6e19713ddd647e033253",
"versionType": "git"
},
{
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"lessThan": "1579342d71133da7f00daa02c75cebec7372097b",
"versionType": "git"
}
],
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-64543
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41075 · Revision 1
- Added to Heist Feed
- Publisher date