Linux Kernel EUVD-2026-108848

Requires: (1) a kernel built with CONFIG_TIPC and the TIPC module loaded and actively configured with a bearer and at least one peer node; (2) local access with CAP_NET_ADMIN (needed to invoke the TIPC generic-netlink LINK_SET/LINK_GET/LINK_RESET_STATS handlers that look up the node by link name); and (3) winning the race in which tipc_node_timeout() clears links and queues tipc_node_free() on a down peer precisely while a handler has resolved the node via tipc_node_find_by_name() but not yet taken a reference. LIMITING FACTORS: TIPC is not enabled or configured in most default Linux installations; the attacker must already be local and privileged (CAP_NET_ADMIN), not remote/unauthenticated; and exploitation depends on a timing window against timer-driven cleanup of a down peer, so it is not a deterministic single-shot trigger.

Signals are internally consistent and point to a genuine but non-urgent, locally-scoped kernel flaw rather than a mass-exploitation priority. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, S:U, C:H/I:H/A:H, base 7.8) describes a local, already-privileged attacker achieving full confidentiality/integrity/availability impact - classic kernel use-after-free leading to potential local privilege escalation. EPSS is low (0.21%, 10th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week', i.e. prioritize for patching within the week but not an emergency. No SSVC exploitation/automatable/technical-impact decision points were supplied, so that framework cannot be applied here. One tension worth noting: the description explicitly characterizes the bug as a race between tipc_node_timeout() cleanup and the netlink handlers, which usually argues for higher attack complexity than the AC:L in the input vector suggests - see assessed_cvss_vector. The 'Information Disclosure' tag also understates impact: this is a use-after-free with full C/I/A impact (effectively CWE-416), not merely an info leak. Net: a real issue to patch on normal kernel-update cadence, bounded by the need for local access, TIPC being configured, and winning a timing race.

A local user holding CAP_NET_ADMIN on a host where the TIPC subsystem is loaded and configured issues TIPC netlink LINK_SET/LINK_GET/LINK_RESET_STATS commands against a peer node that is concurrently being torn down by the node timer, causing a handler to lock and dereference a node object that tipc_node_free() has already freed. By grooming the freed slab allocation, the attacker can turn the use-after-free write into kernel memory corruption and potential privilege escalation. No public exploit reference is provided; the commit's KASAN trace was produced by a local reproducer (task named 'poc'), but working exploit code is not in the supplied data.