Linux Kernel EUVD-2026-108849

Exploitation requires that the Linux kernel be built with and actively running the TIPC topology server (the tipc module and topology service in use), which is non-default on most systems. The attacker needs local access and must drive the specific teardown path in tipc_topsrv_stop()/tipc_topsrv_exit_net() - typically by holding subscriber connections open and generating subscription events while the send/receive workqueues are still running during network-namespace exit. It is fundamentally a race (per the description), so success depends on winning a narrow timing window during teardown; this timing dependence, the requirement that TIPC be enabled/in use, and the need for local low-privilege access are the principal limiting factors that reduce realistic risk below the raw local-vector CVSS score. No remote or unauthenticated path is indicated.

This is a local, low-complexity-on-paper but race-dependent kernel teardown flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Linux TIPC topology server. The CVSS vector agrees with the description on the local vector and low privilege requirement, but the description explicitly attributes the failures to a race ('That race produced several teardown failures'), which argues the AC:L in the supplied vector understates trigger difficulty - winning a teardown timing window is not trivial, so I assess AC:H. Signals are internally consistent toward MODERATE real-world priority rather than emergency: EPSS is 0.21% (10th percentile), there is no CISA KEV listing, and the only references are kernel.org stable patch commits - no PoC or exploit reference is present, so no public exploit is identified. The vuln.today decision label is 'this_week', consistent with a patch-available, non-actively-exploited memory-corruption bug. The practical exploitability ceiling is further lowered because the affected code path is the TIPC subsystem, which must be compiled in and in use. No KEV/EPSS conflict exists here; all exploitation signals point the same low-urgency-of-active-attack direction, while the memory-safety impact (use-after-free, refcount add on 0) keeps technical severity high. CWE is N/A in the input, but the description is unambiguously a use-after-free / refcount race during teardown - note the 'Information Disclosure' tag does not match this memory-corruption class.

A local user on a host where the TIPC topology server is active opens subscriber connections and generates subscription events, then induces the topology server teardown (e.g. via network-namespace exit). If the attacker wins the race, in-flight send/recv work drops the last connection reference during the conn_idr walk, producing a use-after-free in tipc_conn_close() and refcount addition on 0. No public exploit or PoC reference is present in the supplied data; exploitation requires local access and winning a timing window.