SB20260815327 - Use-after-free in Linux kernel tipc

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-72404)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the TIPC UDP media bearer cleanup logic in net/tipc/udp_media.c when tearing down a bearer while concurrent transmit or receive operations are still accessing cached destinations or bearer state under RCU protection. A local attacker can trigger concurrent TIPC UDP activity during bearer cleanup to cause a denial of service.

The issue can affect concurrent transmitters through replicast destination cache access and concurrent receivers through access to the bearer structure after teardown begins.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c
• https://git.kernel.org/stable/c/7116764ca53ff529335d7ab7c364a69f094b23a5