Linux Kernel: TIPC Subsystem Use-After-Free (CVE-2026-99246)

The Linux kernel TIPC (Transparent Inter Process Communication) subsystem contains a use-after-free vulnerability (CVE-2026-99246) caused by improper locking during the tipc_node_reset_links trace event. The vulnerability arises because the trace event executes without holding the node lock, allowing a link to be freed by a concurrent bearer teardown process while the trace callback is attempting to dump the link. This race condition results in a memory corruption scenario as tipc_link_dump() dereferences a stale pointer.

Impact

The vulnerability allows an unprivileged local attacker or a process with sufficient privileges to interact with the TIPC subsystem to trigger a use-after-free condition. This likely results in a kernel panic or system crash (Denial of Service). There is no confirmed evidence of remote exploitation or privilege escalation, though memory corruption bugs can occasionally be leveraged for such purposes in specialized environments.

Recommendation

Update the Linux kernel to a version containing the fix for CVE-2026-99246. As the vulnerability requires specific race conditions within the TIPC subsystem, systems that do not utilize TIPC may reduce their attack surface by disabling the module (e.g., via modprobe -r tipc or blacklisting).