UBUNTU-CVE-2026-74609: Use After Free
In the Linux kernel, the following vulnerability has been resolved: tipc: read le->link under the node lock in tipcnodelinkdown() tipcnodelinkdown() caches the link pointer before taking n->lock: struct tipclink l = le->link; / unlocked / if (!l) return; tipcnodewritelock(n); if (!tipclinkisestablishing(l)) { / deref l / ... tipclinkreset(l); / write into l / if (delete) { kfree(l); le->link = NULL; The delete=true caller frees that very object under n->lock, so the lock does not protect the cached pointer against it: - CPU A, delete=false: tipcrcv() on TIPCLINKDOWNEVT, or the link supervision timer via tipcnodetimeout(), reads l unlocked and then dereferences it under n->lock; - CPU B, delete=true: netlink TIPCNLBEARERDISABLE -> bearerdisable() -> tipcnodedeletelinks() -> tipcnodelinkdown(n, bearerid, true) -> kfree(l). The link is freed with plain kfree(), not kfreercu(), and for UDP bearers disablemedia() only schedules the asynchronous cleanupbearer() work, so its synchronizenet() runs after the links are already gone. An in-flight CPU A that has read l therefore dereferences freed memory once B frees it: a use-after-free read in tipclinkisestablishing(), and a use-after-free write via tipclinkreset() on the establishing branch. The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6: BUG: KASAN: slab-use-after-free in tipclinkisestablishing (net/tipc/link.c:285) Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0 tipclinkisestablishing (net/tipc/link.c:285) tipcnodelinkdown (net/tipc/node.c:1076) tipcnodetimeout (net/tipc/node.c:843) Allocated by task 9549: tipclinkcreate (net/tipc/link.c:490) tipcnodecheckdest (net/tipc/node.c:1279) tipcdiscrcv (net/tipc/discover.c:252) tipcudprecv (net/tipc/udpmedia.c:389) Freed by task 9549: tipcnodelinkdown (net/tipc/node.c:1084) tipcnodedeletelinks (net/tipc/node.c:1320) bearerdisable (net/tipc/bearer.c:414) tipcnlbearerdisable (net/tipc/bearer.c:992) Move the le->link read inside tipcnodewritelock(), so it is serialised against the kfree() in the delete path. A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1117.124~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1123.132~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1122.131~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1118.128~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-198.208~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1112.118~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-195.205~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-198.208 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1122.131 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1113.119 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1100.108 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1112.118 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1109.114 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-195.205 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1112.113 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.15.0-1080.84 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1101.103 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1109.111 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1116.125 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-198.208+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128+fips1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Compensating control
In tipc_node_link_down(), move the le->link read inside tipc_node_write_lock() so it is serialized against link deletion and kfree(); do not cache the link pointer before acquiring n->lock.
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
An attacker or local actor needs the ability to cause a TIPC link-down event or link-supervision timeout to race with disabling a TIPC bearer through the netlink TIPC_NL_BEARER_DISABLE path. The race involves one CPU reading a link pointer while another deletes and frees that link.
Are UDP TIPC bearers relevant to this issue?
Yes. For UDP bearers, disable_media() schedules asynchronous cleanup work, and its synchronize_net() occurs only after the links have already been removed. This leaves an in-flight operation able to dereference a link pointer after it has been freed.
What is the potential impact if the race is won?
The vulnerable path can dereference freed kernel memory, resulting in a use-after-free read. The published severity vector rates confidentiality, integrity, and availability impact as high.