CVE-2026-64543

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tipc: fix use-after-free of the discoverer in tipc_disc_rcv()<br /> <br /> bearer_disable() frees b-&gt;disc with tipc_disc_delete()&amp;#39;s plain kfree(),<br /> but tipc_disc_rcv() still dereferences b-&gt;disc in RX softirq under<br /> rcu_read_lock() (tipc_udp_recv -&gt; tipc_rcv -&gt; tipc_disc_rcv).<br /> <br /> L2 bearers are safe thanks to the synchronize_net() in<br /> tipc_disable_l2_media(), but the UDP bearer defers that call to the<br /> cleanup_bearer() workqueue, so the discoverer is freed with no grace<br /> period:<br /> <br /> BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)<br /> Read of size 8 at addr ffff88802348b728 by task poc_tipc/184<br /> <br /> tipc_disc_rcv (net/tipc/discover.c:149)<br /> tipc_rcv (net/tipc/node.c:2126)<br /> tipc_udp_recv (net/tipc/udp_media.c:391)<br /> udp_rcv (net/ipv4/udp.c:2643)<br /> ip_local_deliver_finish (net/ipv4/ip_input.c:241)<br /> <br /> Freed by task 181:<br /> kfree (mm/slub.c:6565)<br /> bearer_disable (net/tipc/bearer.c:418)<br /> tipc_nl_bearer_disable (net/tipc/bearer.c:1001)<br /> <br /> The bearer is freed with kfree_rcu(); free the discoverer the same way.<br /> Add an rcu_head to struct tipc_discoverer and free it and its skb from an<br /> RCU callback.<br /> <br /> Because the RCU callback (tipc_disc_free_rcu) lives in module text, a<br /> call_rcu() that is still pending when the tipc module is unloaded would<br /> invoke a freed function. Add an rcu_barrier() to tipc_exit() after the<br /> bearer subsystem has been torn down, so all pending discoverer callbacks<br /> have run before the module text goes away.<br /> <br /> Reachable from an unprivileged user namespace: the TIPCv2 genl family is<br /> netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC<br /> and CONFIG_TIPC_MEDIA_UDP.