SB20261103134 - Use-after-free in Linux kernel tipc
Published: November 3, 2026
Security Bulletin ID
SB20261103134
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Use-after-free (CVE-ID: CVE-2026-99246)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service in the Linux kernel.
The vulnerability exists due to a use-after-free in the TIPC node reset tracing code when dumping link entries without holding the node lock during concurrent bearer teardown. A local user can trigger concurrent link reset and bearer teardown operations to cause tipc_link_dump() to dereference a freed link, potentially crashing the kernel.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044
- https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d
- https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236
- https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f
- https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b
- https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2
- https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e
- https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751