Use-after-free in Linux kernel - CVE-2026-72404

Vulnerability details

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the TIPC UDP media bearer cleanup logic in net/tipc/udp_media.c when tearing down a bearer while concurrent transmit or receive operations are still accessing cached destinations or bearer state under RCU protection. A local attacker can trigger concurrent TIPC UDP activity during bearer cleanup to cause a denial of service.

The issue can affect concurrent transmitters through replicast destination cache access and concurrent receivers through access to the bearer structure after teardown begins.

Affected software

How to mitigate CVE-2026-72404

External References

• https://git.kernel.org/stable/c/1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c
• https://git.kernel.org/stable/c/7116764ca53ff529335d7ab7c364a69f094b23a5

Related Security Bulletins

• Use-after-free in Linux kernel tipc