tipc: fix NULL deref in tipc_named_node_up() on empty publication list
In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipc_named_node_up() on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry (publication) into the TIPC name table. If the number of these publications exceeds TIPC_MAX_PUBL (65535), protocol service types (such as node state and link state) are no longer inserted into the name table. This causes two issues: 1. User-space applications subscribing to node or link up/down events stop receiving notifications. 2. A NULL pointer dereference can occur: BUG: kernel NULL pointer dereference, address: 00000000000000d0 ... CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc4-default+ #5 PREEMPT(full) ... RIP: 0010:tipc_named_node_up (./include/linux/skbuff.h:2251 net/tipc/name_distr.c:195 net/tipc/name_distr.c:221) ... Call Trace: tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:934 net/tipc/node.c:2189) tipc_udp_recv (net/tipc/udp_media.c:389) Thread 1 (tipc_net_finalize) | Thread 2 (named_distribute) -----------------------------|----------------------------- | ... | list_for_each_entry(publ, pls, binding_node) { | ... | __skb_queue_tail(list, skb); | ... | } | ... | hdr = buf_msg(skb_peek_tail(list)); ... | tipc_nametbl_publish(); | If 'tipc_nametbl_publish()' (Thread 1) fails because the number of local publications reaches TIPC_MAX_PUBL,
CVE-2026-98098
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98098
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a5e7ac5ce134d8f72f59631011fafa7bbf7ca174",
"lessThan": "246a4b4aace490664927042e93400a6f940d197f",
"versionType": "git"
},
{
"status": "affected",
"version": "a5e7ac5ce134d8f72f59631011fafa7bbf7ca174",
"lessThan": "6188cf0c989dea60f2efe800eaebb7d0bd16e2b2",
"versionType": "git"
},
{
"status": "affected",
"version": "a5e7ac5ce134d8f72f59631011fafa7bbf7ca174",
"lessThan": "b5344e459996afb45e30fdc407b41e6674793b21",
"versionType": "git"
},
{
"status": "affected",
"version": "a5e7ac5ce134d8f72f59631011fafa7bbf7ca174",
"lessThan": "68619f965329d2f7b113a3d5811aa23198f39105",
"versionType": "git"
},
{
"status": "affected",
"version": "a5e7ac5ce134d8f72f59631011fafa7bbf7ca174",
"lessThan": "ad805326d874062f8bc72a94884f86046148cde3",
"versionType": "git"
},
{
"status": "affected",
"version": "a5e7ac5ce134d8f72f59631011fafa7bbf7ca174",
"lessThan": "d0d82f1214f321143c5dbc2e48e4a4e6c4226895",
"versionType": "git"
},
{
"status": "affected",
"version": "a5e7ac5ce134d8f72f59631011fafa7bbf7ca174",
"lessThan": "b3b76e9f4f2476f1135b2ba7743a821db4a0df4b",
"versionType": "git"
}
],
"programFiles": [
"net/tipc/name_table.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/tipc/name_table.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98098
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38201 · Revision 1
- Added to Heist Feed
- Publisher date