AZL-112598: CVE-2026-99246 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
tipc: protect node reset trace dump with node lock
The tipcnoderesetlinks trace event asks tipcnodedump() to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock.
This permits bearer teardown to free a link while the trace callback is dumping it:
CPU 0 CPU 1 tracetipcnoderesetlinks() tipcnodedump() l = n->links[0].link tipcnodewritelock() kfree(l) n->links[0].link = NULL tipcnodewriteunlock() tipclinkdump(l)
tipclinkdump() then dereferences the stale pointer. KASAN reported:
BUG: KASAN: slab-use-after-free in tipclinkdump Read of size 4 by task poc/115 Call Trace: tipclinkdump+0x10cb/0x16b0 tipcnodedump+0x4bb/0x740 traceeventraweventtipcnodeclass+0x258/0x360 tipcnoderesetlinks+0x14d/0x1a0 tipcrcv+0x13f5/0x3030 tipcudprecv+0x4e3/0x670 Allocated by task 0: tipclinkcreate+0x1e1/0x1020 tipcnodecheckdest+0x7d2/0x11a0 tipcdiscrcv+0xdbf/0x1430 Freed by task 89: kfree+0x131/0x3c0 tipcnodelinkdown+0x267/0x4b0 tipcnodedeletelinks+0xec/0x160 bearerdisable+0x107/0x260
Take the node write lock around the trace event. This serializes the dump against tipcnodelinkdown(delete=true), which frees the link under the same write lock.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel's TIPC subsystem are relevant. The race involves a TIPC node's link entries being inspected by a trace event while a bearer teardown deletes those links.
What conditions are needed to trigger the issue?
The vulnerable path requires concurrent execution of the TIPC node-reset trace dump and bearer teardown. The teardown can free a link after the trace callback obtains its pointer but before tipc_link_dump() dereferences it.
How can I identify signs that the issue has occurred?
KASAN may report a slab use-after-free in tipc_link_dump, with a call trace including tipc_node_dump, trace_event_raw_event_tipc_node_class, tipc_node_reset_links, tipc_rcv, and tipc_udp_recv. The freeing path may include tipc_node_link_down, tipc_node_delete_links, and bearer_disable.