CVE-2026-64543

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel within the TIPC (Transparent Inter-Process Communication) module. The bearer disable() function frees the discoverer using tipc disc delete() with a plain kfree(), while tipc disc rcv() may still dereference the discoverer in the RX softirq under rcu read lock(). This occurs specifically with the UDP bearer because it defers the call to the cleanup bearer() workqueue, resulting in the discoverer being freed without a grace period. This condition is reachable from an unprivileged user namespace when CONFIG TIPC and CONFIG TIPC MEDIA UDP are enabled. The execution flow leading to the issue involves the functions tipc udp recv(), tipc rcv(), and tipc disc rcv().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.