CVE-2026-99053

In the Linux kernel, the following vulnerability has been resolved:

tipc: hold a reference to nodes found by link name

tipc node find by name() returns a node after dropping its RCU read lock without taking a reference. The LINK SET, LINK GET and LINK RESET STATS handlers then lock and access the node, racing with timer-driven cleanup of a down peer. Generic netlink serialization does not exclude the node timer.

The following interleaving can leave a handler using a freed node:

CPU 0: find the node under RCU and release the node read lock CPU 1: tipc node timeout() clears the links and unlinks the down node CPU 1: drop the list and timer references, queuing tipc node free() CPU 0: leave the RCU read-side critical section CPU 1: complete the grace period and free the node CPU 0: acquire the node lock through the stale pointer

LINK SET also uses the node's media address after releasing the node lock, when passing queued packets to tipc bearer xmit().

KASAN on v7.3-rc5 reported:

BUG: KASAN: slab-use-after-free in raw read lock bh Write of size 4 at addr ffff88807e06f008 by task poc/92 Call Trace: raw read lock bh kernel/locking/spinlock.c:287 tipc nl node set link net/tipc/node.c:2475 genl family rcv msg doit net/netlink/genetlink.c:1114 genl rcv msg net/netlink/genetlink.c:1209 netlink rcv skb net/netlink/af netlink.c:2575

Allocated by task 0: tipc node create net/tipc/node.c:539 tipc node check dest net/tipc/node.c:1196 tipc disc rcv net/tipc/discover.c:252

Freed by task 92: kfree mm/slub.c:6801 rcu core kernel/rcu/tree.c:2919

Last potentially related work creation: call rcu common.constprop.0 kernel/rcu/tree.c:3181 tipc node timeout net/tipc/node.c:814

Acquire a reference to the selected node with kref get unless zero() before leaving RCU, returning NULL if the node has already been released. Release that reference on every caller exit after the last node access, including transmission in LINK SET. Keep the existing link lookup order and locking so concurrent link removal still takes the existing error paths.