{"id":"CVE-2026-99246","revision":"1e7b0d70b15f4c22ae906308602bc3d9","records":[{"revision":"1e7b0d70b15f4c22ae906308602bc3d9","observedAt":"2026-11-03T12:57:16.958+00:00","statement":{"source":"cve-program","id":"CVE-2026-99246","aliases":[],"title":"tipc: protect node reset trace dump with node lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n CPU 0 CPU 1\n trace_tipc_node_reset_links()\n tipc_node_dump()\n l = n->links[0].link\n tipc_node_write_lock()\n kfree(l)\n n->links[0].link = NULL\n tipc_node_write_unlock()\n tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in tipc_link_dump\n Read of size 4 by task poc/115\n Call Trace:\n tipc_link_dump+0x10cb/0x16b0\n tipc_node_dump+0x4bb/0x740\n trace_event_raw_event_tipc_node_class+0x258/0x360\n tipc_node_reset_links+0x14d/0x1a0\n tipc_rcv+0x13f5/0x3030\n tipc_udp_recv+0x4e3/0x670\n Allocated by task 0:\n tipc_link_create+0x1e1/0x1020\n tipc_node_check_dest+0x7d2/0x11a0\n tipc_disc_rcv+0xdbf/0x1430\n Freed by task 89:\n kfree+0x131/0x3c0\n tipc_node_link_down+0x267/0x4b0\n tipc_node_delete_links+0xec/0x160\n bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock.","state":0,"publishedAt":"2026-11-03T11:18:25.838+00:00","modifiedAt":"2026-11-03T11:18:25.838+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/tipc/node.c\"\n ],\n \"versions\": [\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"c8b72ca0918e95f708f67c8b3e69b05290f2b6d2\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"6e492cb98ca69cc1145175e23e22e3b84da7f26d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"7bb6a35bd6d69019539d8782fb590fd2aa8a3236\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"6abd93d01b0f495f29201925a5ee8e6a583c4044\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"a6101d62ccfa153db8c218ce59362b8e0316fd4f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"fa8c78c0e49aa11fae116fd841e41aa8f2d68751\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"eb18a510b5cd4daeb9736ad8db57a9fc49db185b\",\n \"lessThan\": \"dddf197f29ba5e47a476dde82bf542ca2e0d5e5e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/tipc/node.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.0\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.0\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.273\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.224\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.191\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.161\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.115\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.59\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.13\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2","https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d","https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236","https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044","https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f","https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b","https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751","https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99246","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99246","identifiers":["CVE-2026-99246"]},"retained":false,"historicalAffected":[]}],"coverage":[]}