{"id":"CVE-2026-99246","kind":"vulnerability","aliases":["CVE-2026-99246"],"related":[],"title":"Linux kernel TIPC: use-after-free in node reset trace dump","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n  CPU 0                                CPU 1\n  trace_tipc_node_reset_links()\n    tipc_node_dump()\n      l = n->links[0].link\n                                       tipc_node_write_lock()\n                                       kfree(l)\n                                       n->links[0].link = NULL\n                                       tipc_node_write_unlock()\n      tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_dump\n  Read of size 4 by task poc/115\n  Call Trace:\n   tipc_link_dump+0x10cb/0x16b0\n   tipc_node_dump+0x4bb/0x740\n   trace_event_raw_event_tipc_node_class+0x258/0x360\n   tipc_node_reset_links+0x14d/0x1a0\n   tipc_rcv+0x13f5/0x3030\n   tipc_udp_recv+0x4e3/0x670\n  Allocated by task 0:\n   tipc_link_create+0x1e1/0x1020\n   tipc_node_check_dest+0x7d2/0x11a0\n   tipc_disc_rcv+0xdbf/0x1430\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   tipc_node_link_down+0x267/0x4b0\n   tipc_node_delete_links+0xec/0x160\n   bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock.","summary":"The TIPC networking code in the Linux kernel can read a link structure after another thread has freed it, because a trace event dumps link data without holding the node lock. A local or network-reachable trigger can cause a kernel memory read of freed memory, which can crash the system or lead to code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubernetes","linux-kernel","runtime","self-hosted","tipc"],"not_affected_if":["non-linux","tipc-not-loaded"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel releases in the kernel git history.\n- Check whether the TIPC module is loaded with `lsmod | grep tipc`; if it is absent, the flaw is not reachable.","fix":"- Apply the Linux kernel stable update that includes the commit 'tipc: protect node reset trace dump with node lock'; fixed versions are unknown from the sources.","status":"open","published_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","triaged_at":"2026-11-03T12:23:02+00:00","updated_at":"2026-11-03T12:23:02+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T12:23:02Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Linux kernel stable update that includes the commit 'tipc: protect node reset trace dump with node lock'; fixed versions are unknown from the sources.","reach":"network","title":"Linux kernel TIPC: use-after-free in node reset trace dump","impact":"high","summary":"The TIPC networking code in the Linux kernel can read a link structure after another thread has freed it, because a trace event dumps link data without holding the node lock. A local or network-reachable trigger can cause a kernel memory read of freed memory, which can crash the system or lead to code execution.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","tipc","self-hosted","kubernetes"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"kernel memory read after free; possible crash or code execution","analyst_note":"Confirm affected kernel version ranges and the fixed stable release from the kernel.org or NVD entry for CVE-2026-99246.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed kernel releases in the kernel git history.\n- Check whether the TIPC module is loaded with `lsmod | grep tipc`; if it is absent, the flaw is not reachable.","plain_action":"","needs_analyst":true,"not_affected_if":["tipc-not-loaded","non-linux"],"who_is_affected":"Only systems running a Linux kernel with the TIPC protocol module loaded are exposed; TIPC is used mainly in clustered environments. Systems without TIPC loaded, or without the module built in, can skip it. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000781,"input_tokens":4691,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':222C,227C,236C,242C,246C,251C,260C,266C,271C,278C,284C,290C,294C '-2026':14A,17A '-99246':15A,18A '0':154C,168C,178C,256C '1':156C '4':213C '89':276C 'alloc':253C 'anoth':42B 'around':301C 'ask':111C 'bearer':140C,292C 'bug':199C 'call':217C 'callback':149C 'caus':67B 'check':264C 'class':235C 'code':31B,83B 'cpu':153C,155C 'crash':77B 'creat':259C 'cve':13A,16A 'data':53B,130C 'delet':288C,314C 'derefer':193C 'dest':265C 'disabl':293C 'disc':269C 'dump':12A,51B,100C,114C,151C,164C,187C,191C,209C,221C,226C,308C 'entri':121C 'event':50B,110C,126C,132C,230C,232C,304C 'execut':84B 'follow':90C 'free':7A,143C,205C,317C 'freed':45B,73B,273C 'hold':55B 'host':26B 'kasan':197C,200C 'kernel':2A,22B,35B,69B,88C 'kfree':174C,277C 'kubernet':19B 'l':165C,175C,188C 'lead':81B 'link':39B,52B,108C,120C,129C,145C,161C,167C,169C,177C,179C,186C,190C,208C,220C,241C,258C,282C,289C,312C,319C 'linux':1A,21B,34B,87C 'linux-kernel':20B 'local':60B 'lock':58B,103C,137C,173C,300C,324C 'memori':70B,74B 'n':166C,176C 'network':30B,63B 'network-reach':62B 'node':9A,57B,97C,102C,106C,113C,118C,125C,136C,159C,163C,171C,182C,225C,234C,239C,263C,281C,287C,298C,311C 'null':180C 'permit':139C 'poc/115':216C 'pointer':196C 'protect':96C 'raw':231C 'rcv':245C,270C 'reachabl':64B 'read':37B,71B,210C 'recv':250C 'report':198C 'request':128C 'reset':10A,98C,107C,160C,240C 'resolv':94C 'run':133C 'runtim':23B 'self':25B 'self-host':24B 'serial':306C 'size':212C 'slab':202C 'slab-use-after-fre':201C 'stale':195C 'structur':40B 'system':79B 'take':296C 'task':215C,255C,275C 'teardown':141C 'thread':43B 'tipc':3A,27B,29B,95C,105C,112C,158C,162C,170C,181C,185C,189C,207C,219C,224C,233C,238C,244C,248C,257C,262C,268C,280C,286C,310C 'trace':11A,49B,99C,109C,148C,157C,218C,229C,303C 'trigger':65B 'true':315C 'udp':249C 'unlik':122C 'unlock':184C 'use':5A,203C 'use-after-fre':4A 'vulner':91C 'walk':116C 'without':54B,134C 'write':172C,183C,299C,323C 'x107/0x260':295C 'x10cb/0x16b0':223C 'x131/0x3c0':279C 'x13f5/0x3030':247C 'x14d/0x1a0':243C 'x1e1/0x1020':261C 'x258/0x360':237C 'x267/0x4b0':285C 'x4bb/0x740':228C 'x4e3/0x670':252C 'x7d2/0x11a0':267C 'xdbf/0x1430':272C 'xec/0x160':291C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the TIPC protocol module loaded are exposed; TIPC is used mainly in clustered environments. Systems without TIPC loaded, or without the module built in, can skip it. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["kubernetes","linuxkernel","runtime","selfhosted","tipc","unknown"],"first_public_at":"2026-11-03T12:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99246","severity":null,"published_at":"2026-11-03T12:17:31+00:00","modified_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","fetched_at":"2026-11-03T12:20:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}