Linux Kernel (Unspecified Versions Prior to Fix) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/linux-kernel-unspecified-versions-prior-to-fix/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 02:27:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux Kernel: TIPC Subsystem Use-After-Free (CVE-2026-99246)https://feed.craftedsignal.io/briefs/2026-11-linux-kernel-tipc-use-after-free/Wed, 04 Nov 2026 02:27:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-linux-kernel-tipc-use-after-free/A race condition in the Linux kernel TIPC subsystem allows a local attacker to trigger a use-after-free vulnerability via concurrent node reset trace events and bearer teardown, potentially leading to system instability or crashes.The Linux kernel TIPC (Transparent Inter Process Communication) subsystem contains a use-after-free vulnerability (CVE-2026-99246) caused by improper locking during the tipc_node_reset_links trace event. The vulnerability arises because the trace event executes without holding the node lock, allowing a link to be freed by a concurrent bearer teardown process while the trace callback is attempting to dump the link. This race condition results in a memory corruption scenario as tipc_link_dump() dereferences a stale pointer.

Impact

The vulnerability allows an unprivileged local attacker or a process with sufficient privileges to interact with the TIPC subsystem to trigger a use-after-free condition. This likely results in a kernel panic or system crash (Denial of Service). There is no confirmed evidence of remote exploitation or privilege escalation, though memory corruption bugs can occasionally be leveraged for such purposes in specialized environments.

Recommendation

Update the Linux kernel to a version containing the fix for CVE-2026-99246. As the vulnerability requires specific race conditions within the TIPC subsystem, systems that do not utilize TIPC may reduce their attack surface by disabling the module (e.g., via modprobe -r tipc or blacklisting).

]]>highadvisory