CVE-2026-99246

In the Linux kernel, the following vulnerability has been resolved:

tipc: protect node reset trace dump with node lock

The tipc node reset links trace event asks tipc node dump() to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock.

This permits bearer teardown to free a link while the trace callback is dumping it:

CPU 0 CPU 1 trace tipc node reset links() tipc node dump() l = n->links[0].link tipc node write lock() kfree(l) n->links[0].link = NULL tipc node write unlock() tipc link dump(l)

tipc link dump() then dereferences the stale pointer. KASAN reported:

BUG: KASAN: slab-use-after-free in tipc link dump Read of size 4 by task poc/115 Call Trace: tipc link dump+0x10cb/0x16b0 tipc node dump+0x4bb/0x740 trace event raw event tipc node class+0x258/0x360 tipc node reset links+0x14d/0x1a0 tipc rcv+0x13f5/0x3030 tipc udp recv+0x4e3/0x670 Allocated by task 0: tipc link create+0x1e1/0x1020 tipc node check dest+0x7d2/0x11a0 tipc disc rcv+0xdbf/0x1430 Freed by task 89: kfree+0x131/0x3c0 tipc node link down+0x267/0x4b0 tipc node delete links+0xec/0x160 bearer disable+0x107/0x260

Take the node write lock around the trace event. This serializes the dump against tipc node link down(delete=true), which frees the link under the same write lock.