CVE-2026-68117

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the TIPC (Transparent Inter-Process Communication) implementation of the Linux kernel. When the tipc sk create() function fails to insert a new socket because the per-netns socket rhashtable reaches its maximum size, the error path calls sk free() to release the socket but fails to clear the sock->sk pointer. This leaves the pointer dangling. While this is not problematic for standard socket creation, it is critical during the accept() path. In this scenario, tipc accept() creates a pre-allocated child socket using tipc sk create(); if this fails, new sock->sk remains dangling and new sock->ops remains non-NULL. Subsequently, do accept() triggers sock release(), which calls tipc release(). This leads to a use-after-free write of the sk lock spinlock when lock sock() is executed on the freed socket object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.