Executive brief
A memory safety vulnerability in the Linux kernel's TIPC networking subsystem allows concurrent threads to access freed memory during UDP bearer shutdown. An attacker with access to trigger TIPC bearer cleanup and concurrent network operations could crash the kernel or potentially execute code, disrupting network services and system stability.
Technical details
The vulnerability is a use-after-free (UAF) in the cleanup_bearer() function of the TIPC UDP media bearer implementation. The root cause is premature destruction of destination cache entries (dst_cache_destroy()) before synchronizing with concurrent RCU readers via synchronize_net(). Concurrent transmitters calling tipc_udp_xmit() or receivers calling tipc_udp_recv() can access already-freed per-CPU cache pointers or released dst entries, causing kernel crashes or reference count imbalances. The attack requires the ability to trigger bearer cleanup while network operations are in flight, which is possible in multi-threaded or networked environments. The fix defers rcast entry destruction to RCU callbacks and ensures proper synchronization before freeing the bearer structure itself. Patches are available in the Linux kernel repository.
Affected products
- Linux Linux kernel affected versions prior to fix (exact version range not specified in advisory)
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: Fix available in Linux kernel repository