Executive brief
A vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) protocol could allow a remote attacker to cause a system crash. The issue occurs when the system processes specifically formatted network messages, leading to a memory management error. This can result in a denial-of-service condition where the affected server or device stops functioning.
Technical details
A double-free vulnerability exists in net/tipc/msg.c within the tipc_buf_append() function. The root cause is that tipc_msg_validate() may reallocate a socket buffer (skb) and free the original, but tipc_buf_append() maintained a stale pointer to the original buffer in its local variables. If validation subsequently fails, the error handling path attempts to free the already-freed original pointer. An attacker can trigger this by sending TIPC messages that fail validation after triggering a reallocation. Patches have been released across multiple stable kernel branches to ensure the headbuf pointer is correctly updated after validation.
Affected products
- Linux Linux 4.15 to 6.13
Timeline
- 2026-06-24: advisory
- 2026-06-24: disclosed
References
- https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9
- https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3
- https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778
- https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6
- https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0
- https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b
- https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a