{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/linux-kernel-unspecified-versions-prior-to-fix/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-99246"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux Kernel (unspecified versions prior to fix)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Linux"],"content_html":"\u003cp\u003eThe Linux kernel TIPC (Transparent Inter Process Communication) subsystem contains a use-after-free vulnerability (CVE-2026-99246) caused by improper locking during the \u003ccode\u003etipc_node_reset_links\u003c/code\u003e trace event. The vulnerability arises because the trace event executes without holding the node lock, allowing a link to be freed by a concurrent bearer teardown process while the trace callback is attempting to dump the link. This race condition results in a memory corruption scenario as \u003ccode\u003etipc_link_dump()\u003c/code\u003e dereferences a stale pointer.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unprivileged local attacker or a process with sufficient privileges to interact with the TIPC subsystem to trigger a use-after-free condition. This likely results in a kernel panic or system crash (Denial of Service). There is no confirmed evidence of remote exploitation or privilege escalation, though memory corruption bugs can occasionally be leveraged for such purposes in specialized environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Linux kernel to a version containing the fix for CVE-2026-99246. As the vulnerability requires specific race conditions within the TIPC subsystem, systems that do not utilize TIPC may reduce their attack surface by disabling the module (e.g., via \u003ccode\u003emodprobe -r tipc\u003c/code\u003e or blacklisting).\u003c/p\u003e\n","date_modified":"2026-11-04T02:27:39Z","date_published":"2026-11-04T02:27:39Z","id":"https://feed.craftedsignal.io/briefs/2026-11-linux-kernel-tipc-use-after-free/","summary":"A race condition in the Linux kernel TIPC subsystem allows a local attacker to trigger a use-after-free vulnerability via concurrent node reset trace events and bearer teardown, potentially leading to system instability or crashes.","title":"Linux Kernel: TIPC Subsystem Use-After-Free (CVE-2026-99246)","url":"https://feed.craftedsignal.io/briefs/2026-11-linux-kernel-tipc-use-after-free/"}],"language":"en","title":"CraftedSignal Threat Feed - Linux Kernel (Unspecified Versions Prior to Fix)","version":"https://jsonfeed.org/version/1.1"}