UBUNTU-CVE-2026-99053: Use After Free

Q: Which Ubuntu kernel packages are in scope?

The affected package list includes ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-azure-fde, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-raspi, and ubuntu/linux-realtime.

Q: What access does an attacker need?

The supplied vector indicates local access with low privileges and no user interaction. The vulnerable paths are the TIPC generic netlink LINK_SET, LINK_GET, and LINK_RESET_STATS handlers.

Q: What is the potential impact of successful exploitation?

The issue is a use-after-free condition with high confidentiality, integrity, and availability impact in the supplied severity vector. A handler can access a node after timer-driven cleanup has freed it.

Q: What change resolves the race condition?

The resolution is to hold a reference to nodes returned by tipc_node_find_by_name() before the RCU read lock is dropped, preventing the node from being freed while a handler uses it.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname() returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node, racing with timer-driven cleanup of a down peer. Generic netlink serialization does not exclude the node timer. The following interleaving can leave a handler using a freed node: CPU 0: find the node under RCU and release the node read lock CPU 1: tipcnodetimeout() clears the links and unlinks the down node CPU 1: drop the list and timer references, queuing tipcnodefree() CPU 0: leave the RCU read-side critical section CPU 1: complete the grace period and free the node CPU 0: acquire the node lock through the stale pointer LINKSET also uses the node's media address after releasing the node lock, when passing queued packets to tipcbearerxmit(). KASAN on v7.3-rc5 reported: BUG: KASAN: slab-use-after-free in rawreadlockbh Write of size 4 at addr ffff88807e06f008 by task poc/92 Call Trace: rawreadlockbh kernel/locking/spinlock.c:287 tipcnlnodesetlink net/tipc/node.c:2475 genlfamilyrcvmsgdoit net/netlink/genetlink.c:1114 genlrcvmsg net/netlink/genetlink.c:1209 netlinkrcvskb net/netlink/afnetlink.c:2575 Allocated by task 0: tipcnodecreate net/tipc/node.c:539 tipcnodecheckdest net/tipc/node.c:1196 tipcdiscrcv net/tipc/discover.c:252 Freed by task 92: kfree mm/slub.c:6801 rcucore kernel/rcu/tree.c:2919 Last potentially related work creation: callrcucommon.constprop.0 kernel/rcu/tree.c:3181 tipcnodetimeout net/tipc/node.c:814 Acquire a reference to the selected node with krefgetunlesszero() before leaving RCU, returning NULL if the node has already been released. Release that reference on every caller exit after the last node access, including transmission in LINKSET. Keep the existing link lookup order and locking so concurrent link removal still takes the existing error paths.

Affected Software

237 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1069.74~22.04.1

6.8.0-1069.74~22.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1073.82~22.04.1

6.8.0-1073.82~22.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1071.78~22.04.1

6.8.0-1071.78~22.04.1

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1073.81~22.04.1

6.8.0-1073.81~22.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8<6.8.0-1069.70~22.04.1

6.8.0-1069.70~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-149.149.1~22.04.1

6.8.0-149.149.1~22.04.1

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1067.71~22.04.1

6.8.0-1067.71~22.04.1

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-149.149~22.04.2

6.8.0-149.149~22.04.2

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.8<6.8.1-1064.65~22.04.1

6.8.1-1064.65~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-149.149

6.8.0-149.149

ubuntu/linux-aws<6.8.0-1069.74

6.8.0-1069.74

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1017.18~24.04.1

7.0.0-1017.18~24.04.1

ubuntu/linux-azure<6.8.0-1073.82

6.8.0-1073.82

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1019.19~24.04.1

7.0.0-1019.19~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1073.81

6.8.0-1073.81

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1017.19~24.04.1

7.0.0-1017.19~24.04.1

ubuntu/linux-gke<6.8.0-1068.77

6.8.0-1068.77

ubuntu/linux-gkeop<6.8.0-1053.57

6.8.0-1053.57

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0*

ubuntu/linux-ibm<6.8.0-1069.70

6.8.0-1069.70

ubuntu/linux-lowlatency<6.8.0-149.149.1

6.8.0-149.149.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1067.70

6.8.0-1067.70

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1067.71

6.8.0-1067.71

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1016.18~24.04.1

7.0.0-1016.18~24.04.1

ubuntu/linux-raspi<6.8.0-1068.72

6.8.0-1068.72

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-43.43.1~24.04.2

7.0.0-43.43.1~24.04.2

ubuntu/linux-vmware<6.8.0-1010.10

6.8.0-1010.10

ubuntu/linux-xilinx*

ubuntu/linux-bluefield<6.8.0-1036.41

6.8.0-1036.41

ubuntu/linux-raspi-realtime<6.8.0-2056.58

6.8.0-2056.58

ubuntu/linux-realtime<6.8.1-1064.65

6.8.1-1064.65

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1069.74+fips1

6.8.0-1069.74+fips1

ubuntu/linux-azure-fips<6.8.0-1073.82+fips1

6.8.0-1073.82+fips1

ubuntu/linux-fips*

ubuntu/linux-gcp-fips<6.8.0-1073.81+fips1

6.8.0-1073.81+fips1

ubuntu/linux<7.3.0-10.10

7.3.0-10.10

ubuntu/linux-aws<7.3.0-1004.4

7.3.0-1004.4

ubuntu/linux-azure<7.3.0-1004.4

7.3.0-1004.4

ubuntu/linux-azure-fde<7.3.0-1004.5

7.3.0-1004.5

ubuntu/linux-gcp<7.3.0-1004.4

7.3.0-1004.4

ubuntu/linux-oracle<7.3.0-1004.4

7.3.0-1004.4

ubuntu/linux-raspi<7.3.0-1004.4

7.3.0-1004.4

ubuntu/linux-realtime<7.3.0-10.10.1

7.3.0-10.10.1

ubuntu/linux-riscv<7.3.0-10.10.1

7.3.0-10.10.1

ubuntu/linux<7.0.0-43.43

7.0.0-43.43

ubuntu/linux-aws<7.0.0-1017.18

7.0.0-1017.18

ubuntu/linux-azure<7.0.0-1020.21

7.0.0-1020.21

ubuntu/linux-azure-fde<7.0.0-1019.19

7.0.0-1019.19

ubuntu/linux-gcp<7.0.0-1017.19

7.0.0-1017.19

ubuntu/linux-gke<7.0.0-1010.11

7.0.0-1010.11

ubuntu/linux-ibm<7.0.0-1018.18

7.0.0-1018.18

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1018.18

7.0.0-1018.18

ubuntu/linux-oracle<7.0.0-1016.18

7.0.0-1016.18

ubuntu/linux-raspi*

ubuntu/linux-realtime<7.0.0-43.43.1

7.0.0-43.43.1

ubuntu/linux-riscv*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.74~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.82~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.78~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.81~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.70~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149.1~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.71~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149~22.04.2
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1064.65~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.74
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.18~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.82
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1019.19~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.81
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.19~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1068.77
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.57
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.70
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.71
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.18~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1068.72
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-43.43.1~24.04.2
Upgrade
Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.
Fixed in 6.8.0-1010.10
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1036.41
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2056.58
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1064.65
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.74+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.82+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.81+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.3.0-10.10
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.3.0-1004.4
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.3.0-1004.4
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.3.0-1004.5
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.3.0-1004.4
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.3.0-1004.4
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.3.0-1004.4
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.3.0-10.10.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.3.0-10.10.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-43.43
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.18
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1020.21
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1019.19
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.19
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1010.11
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.18
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-43.43.1
Compensating control
In tipc_node_find_by_name() and its callers, acquire a node reference with kref_get_unless_zero() before leaving the RCU read-side critical section, returning NULL if the node has already been released. Preserve the existing link lookup order and locking, and release the reference on every caller exit after the last node access, including after LINK_SET transmission via tipc_bearer_xmit().

Event History

Oct 23, 2026

CVE Published

via OSV·01:17 PM

Data Sourced

via OSV·01:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are in scope?

The affected package list includes ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-azure-fde, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-raspi, and ubuntu/linux-realtime.

What access does an attacker need?

The supplied vector indicates local access with low privileges and no user interaction. The vulnerable paths are the TIPC generic netlink LINK_SET, LINK_GET, and LINK_RESET_STATS handlers.

What is the potential impact of successful exploitation?

The issue is a use-after-free condition with high confidentiality, integrity, and availability impact in the supplied severity vector. A handler can access a node after timer-driven cleanup has freed it.

What change resolves the race condition?

The resolution is to hold a reference to nodes returned by tipc_node_find_by_name() before the RCU read lock is dropped, preventing the node from being freed while a handler uses it.

UBUNTU-CVE-2026-99053: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are in scope?

What access does an attacker need?

What is the potential impact of successful exploitation?

What change resolves the race condition?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel packages are in scope?

What access does an attacker need?

What is the potential impact of successful exploitation?

What change resolves the race condition?