CVE-2026-72404

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the TIPC UDP media bearer teardown process. The cleanup bearer() function calls dst cache destroy() on replicast caches before calling synchronize net(), which is intended to wait for concurrent RCU readers to finish. Because dst cache destroy() immediately frees per-CPU cache memory and releases cached entries without synchronization, a concurrent transmitter running tipc udp xmit() on another CPU may call dst cache get(), leading to a system crash or an imbalanced put warning. Additionally, calling kfree(ub) immediately after synchronize net() without first closing the socket creates a window where a concurrent receiver running tipc udp recv() can access ub and trigger a UAF. RCU (Read-Copy-Update) is a synchronization mechanism that allows multiple readers to access data while it is being updated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.