Executive brief
The Linux kernel's TIPC (Transparent Inter-Process Communication) protocol handler contains a race condition where a link pointer is freed by one CPU while another CPU is still actively using it. This can crash the system or allow an attacker to execute arbitrary code by triggering link operations (e.g., disabling a network bearer) while TIPC is processing incoming network traffic or timeouts.
Technical details
The vulnerability is a use-after-free race condition in tipc_node_link_down() (net/tipc/node.c:1076). The function caches a link pointer (le->link) before acquiring the node lock, but when delete=true, another code path (bearer_disable) can free the same object under the lock. CPU A may read the cached pointer unlocked and then dereference it under lock after CPU B has freed it via kfree(), leading to use-after-free reads in tipc_link_is_establishing() and writes via tipc_link_reset(). The fix moves the le->link read inside tipc_node_write_lock() to serialize it against the kfree() path. Attack vectors include network-reachable TIPC protocol reception (tipc_rcv) and netlink-based bearer disable operations.
Affected products
- Linux Linux kernel 5.x–7.2.0-rc5 and later (fixed in subsequent releases)
Timeline
- 2026-08-22: disclosed