{"id":"CVE-2026-99053","state":"PUBLISHED","title":"tipc: hold a reference to nodes found by link name","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference.  The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer.  Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n  CPU 0: find the node under RCU and release the node read lock\n  CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n  CPU 1: drop the list and timer references, queuing tipc_node_free()\n  CPU 0: leave the RCU read-side critical section\n  CPU 1: complete the grace period and free the node\n  CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n  BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n  Write of size 4 at addr ffff88807e06f008 by task poc/92\n  Call Trace:\n   _raw_read_lock_bh                 kernel/locking/spinlock.c:287\n   tipc_nl_node_set_link             net/tipc/node.c:2475\n   genl_family_rcv_msg_doit          net/netlink/genetlink.c:1114\n   genl_rcv_msg                      net/netlink/genetlink.c:1209\n   netlink_rcv_skb                   net/netlink/af_netlink.c:2575\n\n  Allocated by task 0:\n   tipc_node_create                  net/tipc/node.c:539\n   tipc_node_check_dest              net/tipc/node.c:1196\n   tipc_disc_rcv                     net/tipc/discover.c:252\n\n  Freed by task 92:\n   kfree                             mm/slub.c:6801\n   rcu_core                          kernel/rcu/tree.c:2919\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0     kernel/rcu/tree.c:3181\n   tipc_node_timeout                 net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released.  Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET.  Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths.","publishedAt":"2026-10-23T12:22:35.462Z","updatedAt":"2026-10-30T12:41:20.179Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"384edc67201f8561b7de952647b923f0524b1f36","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"5b7e58e8be90f4e8530e7a60372d003dfa7fd666","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"92f3b3368722631e933a4db0cf8bd578ed08cd9c","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"b60259d4047fbb735476c729dcf9306a038b6110","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"f17e70206a1e763fcca2578a8db3c4eed0f843a9","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"1428c5f1d346a2e1ac9156713975a72246957009","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"3c3b308ee6e25729a6cf09b69cdd0e093220d40b","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"17e73bae400f6a434dc006e3bee92c94cf781954","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/node.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.11","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/node.c"]}],"references":["https://git.kernel.org/stable/c/384edc67201f8561b7de952647b923f0524b1f36","https://git.kernel.org/stable/c/5b7e58e8be90f4e8530e7a60372d003dfa7fd666","https://git.kernel.org/stable/c/92f3b3368722631e933a4db0cf8bd578ed08cd9c","https://git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110","https://git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9","https://git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009","https://git.kernel.org/stable/c/3c3b308ee6e25729a6cf09b69cdd0e093220d40b","https://git.kernel.org/stable/c/17e73bae400f6a434dc006e3bee92c94cf781954"],"weaknesses":[],"ingestedAt":"2026-10-30T13:02:04.640Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/99xxx/CVE-2026-99053.json","commit":"cb14bf1b43b0c9f05f7f40eae2246263fd430780","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99053","state":"PUBLISHED","datePublished":"2026-10-23T12:22:35.462Z","dateUpdated":"2026-10-30T12:41:20.179Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.388Z"},"containers":{"cna":{"title":"tipc: hold a reference to nodes found by link name","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference.  The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer.  Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n  CPU 0: find the node under RCU and release the node read lock\n  CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n  CPU 1: drop the list and timer references, queuing tipc_node_free()\n  CPU 0: leave the RCU read-side critical section\n  CPU 1: complete the grace period and free the node\n  CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n  BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n  Write of size 4 at addr ffff88807e06f008 by task poc/92\n  Call Trace:\n   _raw_read_lock_bh                 kernel/locking/spinlock.c:287\n   tipc_nl_node_set_link             net/tipc/node.c:2475\n   genl_family_rcv_msg_doit          net/netlink/genetlink.c:1114\n   genl_rcv_msg                      net/netlink/genetlink.c:1209\n   netlink_rcv_skb                   net/netlink/af_netlink.c:2575\n\n  Allocated by task 0:\n   tipc_node_create                  net/tipc/node.c:539\n   tipc_node_check_dest              net/tipc/node.c:1196\n   tipc_disc_rcv                     net/tipc/discover.c:252\n\n  Freed by task 92:\n   kfree                             mm/slub.c:6801\n   rcu_core                          kernel/rcu/tree.c:2919\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0     kernel/rcu/tree.c:3181\n   tipc_node_timeout                 net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released.  Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET.  Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"384edc67201f8561b7de952647b923f0524b1f36","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"5b7e58e8be90f4e8530e7a60372d003dfa7fd666","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"92f3b3368722631e933a4db0cf8bd578ed08cd9c","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"b60259d4047fbb735476c729dcf9306a038b6110","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"f17e70206a1e763fcca2578a8db3c4eed0f843a9","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"1428c5f1d346a2e1ac9156713975a72246957009","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"3c3b308ee6e25729a6cf09b69cdd0e093220d40b","versionType":"git"},{"version":"6a939f365bdb03a74b4617bdb4402fc08da088b9","status":"affected","lessThan":"17e73bae400f6a434dc006e3bee92c94cf781954","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/node.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.11","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/node.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/384edc67201f8561b7de952647b923f0524b1f36"},{"url":"https://git.kernel.org/stable/c/5b7e58e8be90f4e8530e7a60372d003dfa7fd666"},{"url":"https://git.kernel.org/stable/c/92f3b3368722631e933a4db0cf8bd578ed08cd9c"},{"url":"https://git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110"},{"url":"https://git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9"},{"url":"https://git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009"},{"url":"https://git.kernel.org/stable/c/3c3b308ee6e25729a6cf09b69cdd0e093220d40b"},{"url":"https://git.kernel.org/stable/c/17e73bae400f6a434dc006e3bee92c94cf781954"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The attacker-controlled selector is TIPC_NLA_LINK_NAME in a local NETLINK_GENERIC TIPC_NL_LINK_GET request, dispatched to tipc_nl_node_get_link() and patched tipc_node_find_by_name(). Remote packets can create or down the peer but cannot invoke this handler, so one remote actor cannot trigger the UAF.\nAC:L - The same local attacker can create TIPC peers in user/network namespaces, stop one so node_lost_contact() sets delete_at, and flood LINK_GET while tipc_node_timeout() performs cleanup. Both sides of this repeatable race are attacker-controlled, and the submitted PoC reached the KASAN UAF.\nPR:L - TIPC_NL_LINK_GET is registered without an administrative permission flag and reaches tipc_nl_node_get_link() for any local netlink caller. Setup mutators use GENL_UNS_ADMIN_PERM and the family has netnsok=true, allowing an unprivileged user to obtain the necessary namespace-local rights.\nUI:N - The attacker can create and stop its own TIPC peer and issue the racing TIPC_NL_LINK_GET requests without any victim action.\nS:U - The stale pointer from tipc_node_find_by_name() corrupts host-kernel tipc_node and tipc_link slab objects; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - TIPC_NL_LINK_GET follows a reclaimed node->links[bearer_id].link into __tipc_nl_add_link(), which copies link names, properties, and statistics into the attacker's netlink reply. Heap grooming can therefore turn the stale node into an arbitrary kernel-read primitive.\nI:H - _raw_read_lock_bh() already performs the reported four-byte write to freed node->lock. With a reclaimed links pointer, TIPC_NL_LINK_RESET_STATS reaches tipc_link_reset_stats(), whose memset() provides an attacker-directed kernel write suitable for further corruption or control-flow hijacking.\nA:H - The observed slab use-after-free occurs while tipc_nl_node_set_link() locks the freed node; corrupted lock state or the subsequent stale node/link dereferences can cause a kernel oops or panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:41:20.179Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"7.2.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}