CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

In the Linux kernel, the following vulnerability has been resolved:

tipc: clear sock->sk on the failed-insert path in tipcskcreate()

When tipcskcreate() fails to insert the new socket (tipcskinsert() returns non-zero), its error path frees the sk with skfree() but leaves sock->sk pointing at the freed object:

if (tipcskinsert(tsk)) { skfree(sk); prwarn("Socket create failed; port number exhausted\n"); return -EINVAL; }

This is harmless for plain socket(): the syscall layer clears sock->ops before releasing, so tipcrelease() is never called. It is not harmless on the accept() path. tipcaccept() creates the pre-allocated child socket with tipcskcreate(net, newsock, 0, kern); on failure it leaves newsock->sk dangling and newsock->ops non-NULL, and doaccept() then fput()s the new file, so sockrelease() -> tipcrelease() runs locksock(newsock->sk) on the freed sk -- a use-after-free write of the sklock spinlock.

tipcrelease() already guards this exact "failed accept() releases a pre-allocated child" case with "if (sk == NULL) return 0;", but the guard is bypassed because tipcskcreate() left sock->sk non-NULL (dangling) rather than NULL.

Clear sock->sk on the failed-insert path so the existing tipcrelease() NULL check fires and the use-after-free is avoided.

The tipcskinsert() failure is reached when the per-netns socket rhashtable hits its maxsize (tskrhtparams.maxsize = 1048576, ~2M elements) -- i.e. once a netns holds ~2M TIPC sockets every insert returns -E2BIG.

BUG: KASAN: slab-use-after-free in locksocknested (net/core/sock.c:3839) Write of size 8 at addr ffff8880047cdc38 by task init/1 locksocknested (net/core/sock.c:3839) tipcrelease (net/tipc/socket.c:638) sockrelease (net/socket.c:710) sockclose (net/socket.c:1501) fput (fs/filetable.c:512) Allocated by task 1: skalloc (net/core/sock.c:2308) tipcskcreate (net/tipc/socket.c:487) tipcaccept (net/tipc/socket.c:2744) doaccept (net/socket.c:2034) Freed by task 1: skdestruct (net/core/sock.c:2391) tipcskcreate (net/tipc/socket.c:504) tipcaccept (net/tipc/socket.c:2744) doaccept (net/socket.c:2034)