{"id":"CVE-2026-99054","kind":"vulnerability","aliases":["CVE-2026-99054"],"related":[],"title":"Linux kernel TIPC: topology server teardown race causes use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver's send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed workqueue from the listener\ndata-ready callback, and an RCU stall in tipc_topsrv_exit_net()\nwhile the walk spun under idr_lock.\n\nClear srv->listener under idr_lock so it acts as a shutdown flag,\nskip queue_work() once it is NULL, destroy the workqueues to flush\nin-flight work, and only then close the remaining connections.\nRefuse tipc_conn_lookup() after that flag is cleared, and drop\nidr_lock when the teardown walk finds no connection, so an\nin-flight subscription event cannot pin idr_in_use while the\nwalk holds the lock.\n\nv3 supersedes the narrower in-thread diff Tung Quang Nguyen\nposted on 2026-09-23. It keeps his teardown order and adds the\nlookup refusal and the empty-idr unlock.","summary":"A race in the Linux kernel TIPC topology server shutdown lets connection and workqueue objects be used after they are freed. The sources do not state what an attacker gains beyond a kernel crash or memory corruption.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted","tipc"],"not_affected_if":["tipc-not-used"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix for tipc: destroy topsrv workqueues before closing connections (version unknown from sources).","status":"open","published_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:00+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:54:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for tipc: destroy topsrv workqueues before closing connections (version unknown from sources).","reach":"unknown","title":"Linux kernel TIPC: topology server teardown race causes use-after-free","impact":"medium","summary":"A race in the Linux kernel TIPC topology server shutdown lets connection and workqueue objects be used after they are freed. The sources do not state what an attacker gains beyond a kernel crash or memory corruption.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","tipc","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; kernel memory corruption or crash during TIPC teardown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected and fixed kernel versions and whether the TIPC module is reachable by unprivileged users.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["tipc-not-used"],"who_is_affected":"Systems running a Linux kernel with the TIPC protocol module, which is used for cluster communication; the sources do not say which kernel versions are affected or whether the module is loaded by default. Hosts that do not use TIPC are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3705,"output_tokens":497,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-09':278C '-2026':14A,17A '-23':279C '-99054':15A,18A '0':136C '2026':277C 'act':198C 'add':286C 'addit':134C 'alreadi':164C 'attack':55B 'beyond':57B 'block':146C 'callback':100C,173C 'cannot':253C 'caus':8A 'clear':190C,234C 'close':79C,84C,159C,222C 'conn':123C,138C,158C,228C 'connect':38B,80C,86C,119C,142C,225C,245C 'corrupt':63B 'could':104C,115C 'crash':60B 'cve':13A,16A 'data':171C 'data-readi':170C 'destroy':75C,165C,210C 'diff':271C 'drop':116C,236C 'empti':293C 'empty-idr':292C 'event':103C,252C 'exit':181C 'failur':131C 'find':243C 'flag':202C,232C 'flight':112C,217C,250C 'flush':214C 'follow':69C 'free':12A,155C 'freed':47B 'gain':56B 'get':139C 'hold':261C 'host':25B 'idr':124C,148C,188C,194C,237C,255C,294C 'in-flight':110C,215C,248C 'in-thread':268C 'keep':281C 'kernel':2A,21B,32B,59B,67C 'last':118C 'let':37B 'linux':1A,20B,31B,66C 'linux-kernel':19B 'listen':169C,192C 'lock':149C,189C,195C,238C,263C 'lookup':229C,288C 'memori':62B 'narrow':267C 'net':182C 'nguyen':274C 'null':209C 'object':41B 'order':284C 'pin':254C 'post':275C 'produc':128C 'quang':273C 'queue':106C,160C,204C 'race':7A,28B,127C 'rcu':176C 'readi':172C 'receiv':94C 'refcount':132C 'refer':120C 'refus':226C,289C 'releas':144C 'remain':224C 'resolv':73C 'run':98C 'runtim':22B 'self':24B 'self-host':23B 'send':92C 'send/recv':113C 'server':5A,35B,90C 'sever':129C 'shutdown':36B,201C 'skip':203C 'socket':99C 'sourc':49B 'spun':186C 'srv':191C 'stall':177C 'state':52B 'still':97C 'stop':83C 'subscrib':85C 'subscript':102C,251C 'subsequ':151C 'supersed':265C 'teardown':6A,130C,241C,283C 'thread':270C 'tipc':3A,26B,33B,74C,81C,157C,179C,227C 'topolog':4A,34B,89C 'topsrv':76C,82C,180C 'tung':272C 'unlock':295C 'use':10A,43B,153C,257C 'use-after-fre':9A,152C 'v3':264C 'vulner':70C 'walk':125C,185C,242C,260C 'whose':143C 'work':108C,114C,161C,205C,218C 'workqueu':40B,77C,95C,166C,212C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the TIPC protocol module, which is used for cluster communication; the sources do not say which kernel versions are affected or whether the module is loaded by default. Hosts that do not use TIPC are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99054","severity":null,"published_at":"2026-10-23T13:17:29+00:00","modified_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99054","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99054","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}