CVE-2026-63801

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.4-1.1

Description A slab-use-after-free read exists in the Linux kernel TIPC encrypted receive path. The tipc aead decrypt() function fails to take a reference on the network namespace (netns) before calling crypto aead decrypt(). When decryption is offloaded asynchronously, the tipc aead decrypt done() function may execute after the bearer's network namespace has been torn down and the per-netns tipc crypto has been freed. This leads to the dereferencing of freed memory when accessing aead->crypto->stats, aead->crypto->net, aead->crypto->aead[], and the node table within the tipc aead decrypt done() and tipc crypto rcv complete() functions.

Recommendations Update the Linux kernel to version 7.1.4-1.1 or later. As a temporary mitigation, restrict the use of the tipc aead decrypt() function or disable crypto-enabled TIPC if not required.