CVE-2026-99054

In the Linux kernel, the following vulnerability has been resolved:

tipc: destroy topsrv workqueues before closing connections

tipc topsrv stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more work, and in-flight send/recv work could drop the last connection reference during the conn idr walk.

That race produced several teardown failures: refcount t addition on 0 from conn get() on a connection whose release was blocked on idr lock, a subsequent use-after-free in tipc conn close(), queue work() on an already destroyed workqueue from the listener data-ready callback, and an RCU stall in tipc topsrv exit net() while the walk spun under idr lock.

Clear srv->listener under idr lock so it acts as a shutdown flag, skip queue work() once it is NULL, destroy the workqueues to flush in-flight work, and only then close the remaining connections. Refuse tipc conn lookup() after that flag is cleared, and drop idr lock when the teardown walk finds no connection, so an in-flight subscription event cannot pin idr in use while the walk holds the lock.

v3 supersedes the narrower in-thread diff Tung Quang Nguyen posted on 2026-09-23. It keeps his teardown order and adds the lookup refusal and the empty-idr unlock.