Use-after-free in Linux kernel - CVE-2026-99246
Published: November 3, 2026
Vulnerability identifier: #VU158995
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99246
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to potentially cause a denial of service in the Linux kernel.
The vulnerability exists due to a use-after-free in the TIPC node reset tracing code when dumping link entries without holding the node lock during concurrent bearer teardown. A local user can trigger concurrent link reset and bearer teardown operations to cause tipc_link_dump() to dereference a freed link, potentially crashing the kernel.
Affected software
Linux kernel
How to mitigate CVE-2026-99246
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044
- https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d
- https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236
- https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f
- https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b
- https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2
- https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e
- https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751