EUVD-2026-64546
GHSA-c6xm-fh9c-399h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the race condition timing dependency between concurrent kernel paths; all other metrics align with NVD assessment.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tipc: read le->link under the node lock in tipc_node_link_down()
tipc_node_link_down() caches the link pointer before taking n->lock:
struct tipc_link *l = le->link; /* unlocked */
if (!l) return; tipc_node_write_lock(n); if (!tipc_link_is_establishing(l)) { /* deref l */ ... tipc_link_reset(l); /* write into l */ if (delete) { kfree(l); le->link = NULL;
The delete=true caller frees that very object under n->lock, so the lock does not protect the cached pointer against it:
- CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link
supervision timer via tipc_node_timeout(), reads l unlocked and then dereferences it under n->lock;
- CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -> bearer_disable()
-> tipc_node_delete_links() -> tipc_node_link_down(n, bearer_id, true) -> kfree(l).
The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers disable_media() only schedules the asynchronous cleanup_bearer() work, so its synchronize_net() runs after the links are already gone. An in-flight CPU A that has read l therefore dereferences freed memory once B frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch.
The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:
BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285) Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0 tipc_link_is_establishing (net/tipc/link.c:285) tipc_node_link_down (net/tipc/node.c:1076) tipc_node_timeout (net/tipc/node.c:843) Allocated by task 9549: tipc_link_create (net/tipc/link.c:490) tipc_node_check_dest (net/tipc/node.c:1279) tipc_disc_rcv (net/tipc/discover.c:252) tipc_udp_recv (net/tipc/udp_media.c:389) Freed by task 9549: tipc_node_link_down (net/tipc/node.c:1084) tipc_node_delete_links (net/tipc/node.c:1320) bearer_disable (net/tipc/bearer.c:414) __tipc_nl_bearer_disable (net/tipc/bearer.c:992)
Move the le->link read inside tipc_node_write_lock(), so it is serialised against the kfree() in the delete path. A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.
AnalysisAI
Use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with low-privilege network administration access to corrupt kernel memory, achieving high impact across confidentiality, integrity, and availability. The flaw exists across multiple stable kernel branches from 5.10 through 7.1.x and is triggered by concurrent execution of TIPC bearer teardown against the link supervision timer or receive path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Local system access - this is not remotely exploitable; AV:L per CVSS confirms the attack vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly identifies local access and low-privilege requirements but assesses AC:L, which may slightly overstate exploitability - the race requires concurrent execution across two distinct kernel code paths, introducing inherent timing dependency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with CAP_NET_ADMIN (or operating within a user network namespace with that capability) configures a TIPC UDP bearer and then races a TIPC_NL_BEARER_DISABLE netlink command against the kernel's concurrent link supervision timer (tipc_node_timeout()) or a TIPC_LINK_DOWN_EVT receive event. When CPU B executes kfree(l) under the node lock while CPU A has already cached the now-freed pointer l without holding the lock, CPU A subsequently dereferences freed kernel heap memory - producing a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() on the establishing branch, potentially enabling kernel memory corruption. … |
| Remediation | Upgrade to a patched kernel version corresponding to the running stable series: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernel versions 5.10.x through 7.1.x and assess exposure based on whether local users hold network administration access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today