Executive brief
The Linux kernel's TIPC (Transparent Inter-Process Communication) networking protocol has a use-after-free vulnerability when socket creation fails on the accept() path. An attacker with the ability to exhaust TIPC socket limits in a namespace (approximately 2 million sockets) can trigger this flaw, leading to denial of service or potential code execution via memory corruption.
Technical details
The vulnerability is a use-after-free write in the TIPC socket layer's tipc_sk_create() function. When tipc_sk_insert() fails (returning non-zero), the code frees the kernel socket object (sk) with sk_free() but leaves the sock->sk pointer dangling instead of clearing it to NULL. On the accept() path, this dangling pointer bypasses the NULL check in tipc_release(), causing __sock_release() to call lock_sock() on the freed object—a use-after-free write to the sk_lock spinlock. The attack requires creating approximately 2 million TIPC sockets in a netns to exhaust the rhashtable max_size limit and trigger the insertion failure. The fix clears sock->sk to NULL on the failed-insert path, allowing the existing tipc_release() guard to prevent the use-after-free.
Affected products
- Linux Linux kernel prior to fix inclusion
Timeline
- 2026-08-10: disclosed