Linux Kernel CVE-2026-72404

Exploitation requires all of the following conditions to be met simultaneously: (1) The TIPC kernel module must be loaded and actively configured with a UDP transport bearer - this is a non-default configuration present primarily in clustered telecom, middleware, or high-availability application environments; (2) The system must be multi-core, as the race occurs between concurrent CPU threads; (3) The attacker must have local access with at minimum low-privilege credentials sufficient to trigger TIPC bearer teardown (e.g., stopping a service, removing a network interface) while UDP transmission is actively occurring; (4) The precise race window between dst_cache_destroy() and a concurrent dst_cache_get() must be hit, which requires timing control typical of kernel exploit development. Systems not loading the tipc module, or systems using TIPC exclusively with Ethernet (non-UDP) bearers, are completely unaffected. The requirement for TIPC UDP bearer configuration is the primary limiting factor that restricts real-world exposure to a narrow class of specialized deployments.

The vendor-assigned CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as Low, which is debatable for a race condition requiring precise cross-CPU timing - an independent assessment of AC:H would reduce the effective score to approximately 7.0. EPSS at 0.20% and the 10th percentile strongly corroborates that exploitation has not been observed and is not expected to be widespread; race-condition kernel UAFs require careful setup and are rarely weaponized outside of targeted research. There is no CISA KEV entry and no POC has been identified. Under the SSVC framework this rates as Exploitation=none, Automatable=no (requires local presence, precise timing, and TIPC UDP bearer configuration), Technical Impact=total - meaning the ceiling of damage is severe but the floor of ease-of-exploitation is high. Even a mid-sized municipal IT team in olsztyn running a TIPC-based clustering solution should treat this as urgent for their specific environment, while general-purpose Linux deployments without TIPC can deprioritize it. The combination of high potential impact with very low exploitation probability makes this a patch-when-convenient item for most organizations, but a patch-immediately item for telecom or cluster operators with TIPC UDP bearers active.

A local user with low-privilege access on a multi-core system running TIPC over a UDP bearer (e.g., a clustered middleware node) initiates network teardown of the TIPC bearer - for example by removing the associated network interface or stopping the TIPC service - while the kernel is simultaneously transmitting cluster traffic on another CPU thread within an RCU read-side critical section. The race between dst_cache_destroy() freeing the per-CPU cache and the concurrent tipc_udp_xmit() calling dst_cache_get() on that same freed memory results in a kernel use-after-free, which may manifest as a kernel panic or, under carefully controlled conditions, arbitrary kernel memory manipulation enabling privilege escalation. No public POC exploit has been identified at time of analysis.