EUVD-2026-86928
GHSA-vgfp-jj93-v4hf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access on host with TIPC enabled
-
DeliveryOpen AF_TIPC sockets, bind >65535 service addresses
-
ExploitExhaust name table so service-type publish fails
-
ExecutionNode-up event processes empty publication list
-
ImpactNULL deref in tipc_named_node_up() crashes kernel (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the TIPC (Transparent Inter-Process Communication) subsystem be compiled into the kernel and actively configured/running - TIPC is a niche clustering protocol not enabled by default in most mainstream distributions, which is the primary real-world limiter. Given that, a local actor needs the ability to create AF_TIPC sockets and bind more than TIPC_MAX_PUBL (65535) local-scope service addresses to exhaust the name table; the crash then occurs when a node-up event processes the resulting empty publication list. Limiting factors per the CVSS vector: local access only (AV:L), low privilege required (PR:L, i.e. a local account able to open TIPC sockets), no user interaction, and availability-only impact (kernel crash) with no confidentiality or integrity effect. |
| Impact | The signals converge on a modest, non-urgent priority. The CVSS 3.1 score of 5.5 (medium) reflects a local, low-privilege, availability-only impact (AV:L/AC:L/PR:L/UI:N/C:N/I:N/A:H) - a kernel crash, not code execution or data exposure. EPSS is very low at 0.18% (6th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis (the referenced git.kernel.org links are the upstream fix commits, not proof-of-concept code). The vuln.today decision label is 'this_month', consistent with 'patch during routine maintenance' rather than emergency action. The signals are internally consistent: a low EPSS, absent KEV, and local-only vector all point to low real-world exploitation likelihood. The one amplifying factor is the affected product - the Linux kernel - but the actual exposure is gated by the TIPC subsystem being compiled in and active, which is uncommon in default deployments. No SSVC automatable/technical-impact breakdown was supplied beyond the decision label, so that framework cannot be fully evaluated. Net: a legitimate availability bug worth patching on a normal cadence, not a drop-everything issue. |
| Exploit ScenarioDerived | A local user on a system where the TIPC clustering protocol is loaded and active opens AF_TIPC sockets and binds more than TIPC_MAX_PUBL (65535) local-scope service addresses, exhausting the name table so that protocol service-type publications (node/link state) can no longer be inserted. A subsequent node-up event then processes an empty publication list and passes NULL to buf_msg(), crashing the kernel (denial of service). No public exploit code is known; the attack is low-complexity but requires local access and an enabled TIPC stack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Local users on systems running the TIPC subsystem can exhaust the TIPC name table by binding more than 65,535 local-scope service addresses, which suppresses protocol service-type publications and can drive a NULL pointer dereference in tipc_named_node_up() when a node-up event processes an empty publication list. The result is a kernel crash and denial of service; confidentiality and integrity are unaffected. Exploitation is limited to kernels with TIPC enabled and configured, no public exploit was identified at time of analysis, and EPSS is low at 0.18% (6th percentile).
RemediationAI
Vendor-released patches are available for the listed stable branches: Linux 7.2.7, 6.12.111, 6.18.53, and 7.3-rc2, corresponding to stable commits d0d82f1214f321143c5dbc2e48e4a4e6c4226895, 68619f965329d2f7b113a3d5811aa23198f39105, ad805326d874062f8bc72a94884f86046148cde3, and b3b76e9f4f2476f1135b2ba7743a821db4a0df4b (see https://git.kernel.org/stable/c/68619f965329d2f7b113a3d5811aa23198f39105 and related links); NVD also references 246a4b4aace490664927042e93400a6f940d197f, 6188cf0c989dea60f2efe800eaebb7d0bd16e2b2, and b5344e459996afb45e30fdc407b41e6674793b21. If TIPC is not required, do not load or blacklist the TIPC kernel module to remove exposure, with the trade-off that TIPC clustering and its services become unavailable; where TIPC is needed, restrict which local accounts can create AF_TIPC sockets and bind service addresses, recognizing that this reduces but does not eliminate the attack surface until the kernel is updated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-98098 is a NULL pointer dereference (CWE-476) in the Linux kernel's TIPC implementation. Each local-scope service address bound by a user-space application inserts a publication into the TIPC name table. When the number of local user publications exceeds TIPC_MAX_PUBL (65535), protocol service types such as node state and link state are no longer inserted. The fix allows node state, link state, and topology server service types to be inserted unconditionally and reduces the maximum local user publications to TIPC_MAX_PUBL - 1 so that the maximum bulk size calculated in tipc_link_set_queue_limits() remains valid. The dereference occurs in tipc_named_node_up()/name_distr.c when tipc_nametbl_publish() fails and a concurrent named_distribute path passes an empty list to buf_msg(), reading through a NULL pointer at offset 0xd0. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H describes a local, low-privilege availability-only crash; TIPC must be compiled in and configured, and the trigger requires AF_TIPC socket access and more than 65,535 local-scope bindings.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local TIPC socket access deterministically exhausts the publication table (AV:L/AC:L/PR:L), no user interaction, and the only effect is a kernel NULL-deref crash, so C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry (publication) into the TIPC name table. If the number of these publications exceeds TIPC_MAX_PUBL (65535), protocol service types (such as node state and link state) are no longer inserted into the name table. This causes two issues:
- User-space applications subscribing to node or link up/down events
stop receiving notifications.
- A NULL pointer dereference can occur:
BUG: kernel NULL pointer dereference, address: 00000000000000d0 ... CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc4-default+ #5 PREEMPT(full) ... RIP: 0010:tipc_named_node_up (./include/linux/skbuff.h:2251 net/tipc/name_distr.c:195 net/tipc/name_distr.c:221) ... Call Trace: <IRQ> tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:934 net/tipc/node.c:2189) tipc_udp_recv (net/tipc/udp_media.c:389)
Thread 1 (tipc_net_finalize) | Thread 2 (named_distribute) -----------------------------|-----------------------------
| ... | list_for_each_entry(publ, pls, binding_node) { | ... | __skb_queue_tail(list, skb); | ... | } | ... | hdr = buf_msg(skb_peek_tail(list)); ... | tipc_nametbl_publish(); |
If 'tipc_nametbl_publish()' (Thread 1) fails because the number of local publications reaches TIPC_MAX_PUBL, list (Thread 2) will be empty. As a result, NULL is passed to 'buf_msg()', leading to a NULL pointer dereference.
Fix these issues by allowing protocol service types (node state, link state, and topology server) to be inserted into the name table unconditionally. This ensures that users subscribing to these types always receive notifications. In addition, the maximum number of local user publications is reduced to (TIPC_MAX_PUBL - 1). This ensures that the maximum bulk size calculated in tipc_link_set_queue_limits() remains valid.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB