CVE-2026-64543

Received Received - Intake

Use-After-Free in Linux Kernel TIPC Module

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 <IRQ> tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) </IRQ> Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-07-28

AI Q&A

2026-07-28

EPSS Evaluated

N/A

NVD

CVE-2026-64543

EUVD

EUVD-2026-49594

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) module. It occurs when the discoverer structure in a TIPC bearer is freed but later accessed by the tipc_disc_rcv() function during packet processing. The issue stems from improper cleanup where the discoverer is freed with kfree() while still being referenced in an RCU read-side critical section.

Detection Guidance

This vulnerability involves a use-after-free in the Linux kernel's TIPC module, specifically in the tipc_disc_rcv function. Detection requires checking for kernel logs indicating slab-use-after-free errors related to tipc_disc_rcv or bearer_disable. Monitor logs for KASAN reports or kernel oops messages. No specific commands are provided in the context to detect this issue.

Impact Analysis

An attacker with access to a vulnerable system could exploit this to cause a kernel crash or execute arbitrary code with kernel privileges. The vulnerability is reachable from unprivileged user namespaces, meaning a local user could trigger it without special permissions. Successful exploitation could lead to system instability or complete compromise.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized code execution or data access on systems handling sensitive data. GDPR requires protection against unauthorized access, while HIPAA mandates safeguards for protected health information. A successful exploit could violate these requirements by compromising system integrity or confidentiality.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. The patch changes how the discoverer structure is freed using RCU callbacks to prevent use-after-free. Disable the TIPC module if not in use, as the vulnerability is reachable from unprivileged user namespaces when CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP are enabled.

Hi! I’m here to help you understand CVE-2026-64543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70