CVE-2026-99053: tipc: hold a reference to nodes found by link name
In the Linux kernel, the following vulnerability has been resolved:
tipc: hold a reference to nodes found by link name
tipcnodefindbyname() returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node, racing with timer-driven cleanup of a down peer. Generic netlink serialization does not exclude the node timer.
The following interleaving can leave a handler using a freed node:
CPU 0: find the node under RCU and release the node read lock CPU 1: tipcnodetimeout() clears the links and unlinks the down node CPU 1: drop the list and timer references, queuing tipcnodefree() CPU 0: leave the RCU read-side critical section CPU 1: complete the grace period and free the node CPU 0: acquire the node lock through the stale pointer
LINKSET also uses the node's media address after releasing the node lock, when passing queued packets to tipcbearerxmit().
KASAN on v7.3-rc5 reported:
BUG: KASAN: slab-use-after-free in rawreadlockbh Write of size 4 at addr ffff88807e06f008 by task poc/92 Call Trace: rawreadlockbh kernel/locking/spinlock.c:287 tipcnlnodesetlink net/tipc/node.c:2475 genlfamilyrcvmsgdoit net/netlink/genetlink.c:1114 genlrcvmsg net/netlink/genetlink.c:1209 netlinkrcvskb net/netlink/afnetlink.c:2575
Allocated by task 0: tipcnodecreate net/tipc/node.c:539 tipcnodecheckdest net/tipc/node.c:1196 tipcdiscrcv net/tipc/discover.c:252
Freed by task 92: kfree mm/slub.c:6801 rcucore kernel/rcu/tree.c:2919
Last potentially related work creation: callrcucommon.constprop.0 kernel/rcu/tree.c:3181 tipcnodetimeout net/tipc/node.c:814
Acquire a reference to the selected node with krefgetunlesszero() before leaving RCU, returning NULL if the node has already been released. Release that reference on every caller exit after the last node access, including transmission in LINKSET. Keep the existing link lookup order and locking so concurrent link removal still takes the existing error paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update TIPC node handling to acquire a reference with kref_get_unless_zero() before using a node returned after releasing the RCU read lock, hold that reference across link handlers and queued-packet transmission, and release it on every caller exit after the final node access, including timer paths.