Linux Kernel EUVD-2026-115776

Two non-default prerequisites must both hold: (1) the TIPC subsystem must be enabled/in use on the target (not loaded by default on typical distributions), and (2) the tipc_node_reset_links tracepoint must be enabled, which normally requires local privileged access to tracefs or an active tracing/monitoring configuration. Beyond those, the attacker must win a genuine race (AC:H) against tipc_node_link_down()/bearer teardown freeing the link. These factors - niche protocol, enabled tracepoint, and timing-dependent race - sharply limit realistic exploitation despite the network-reachable trigger; the leaked freed-memory data is written to the local trace buffer rather than returned to the remote attacker.

This is a use-after-free (effectively CWE-416, though CWE is listed N/A) in the Linux kernel TIPC subsystem: the tipc_node_reset_links trace event walks node link entries without holding the node lock, racing bearer teardown that frees a link. The input CVSS of 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) frames this as a high-severity network-reachable flaw, but several real-world signals pull the priority down. There is no KEV listing, no EPSS score provided, and no public exploit reference in the input, so exploitation is not confirmed and the only supportable status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a patch-available, not-actively-exploited issue. Critically, the C:H/I:H/A:H impact rating looks generous: the primary observable effect is a KASAN-reported read of freed slab memory, whose data lands in the kernel trace buffer (locally readable, so limited remote confidentiality) and whose deref of a stale pointer realistically causes a kernel crash (DoS). AC:H correctly reflects that the description shows a genuine two-CPU race. The biggest caveat the raw score hides: the vulnerable code path only runs when the TIPC subsystem is enabled AND the tipc_node_reset_links tracepoint is active, neither of which is default, so this is a high-CVSS issue with a narrow real-world attack surface rather than a broad emergency.

On a host where the TIPC subsystem is enabled and the tipc_node_reset_links tracepoint is turned on, a remote attacker sends crafted TIPC traffic (reaching tipc_rcv via tipc_udp_recv) to force node link resets while bearer teardown concurrently frees a link structure. Winning this race causes the trace dump to dereference a freed link pointer, crashing the kernel or exposing freed slab contents in the trace buffer. No public exploit is identified at time of analysis; the KASAN report in the description is a developer reproducer, not distributed exploit code.