Use-after-free in Linux kernel - CVE-2026-74609

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_node_link_down() in the TIPC subsystem when handling link-down events and bearer disable operations concurrently. A local user can trigger a race condition that frees a link object while it is still being dereferenced to cause a denial of service.

The issue can result in both a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() during the establishing branch.

Affected software

How to mitigate CVE-2026-74609

External References

• https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd
• https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3
• https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944
• https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a
• https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e
• https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07
• https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882
• https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb

Related Security Bulletins

• Use-after-free in Linux kernel tipc
• Debian update for linux