CVE-2026-74490

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Transparent Inter-Process Communication (TIPC) socket tracepoints. The function tipc sk dump() is used to dump queue state, and while most calls are serialized under a socket lock or sk->sk lock.slock, the tipc poll() function calls trace tipc sk poll() with the TIPC DUMP ALL parameter without holding either lock. This allows the poll trace path to reach tipc list dump() and dump backlog head/tail information while another context dequeues and frees a socket buffer (skb), causing the trace helper to dereference a stale queue entry.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.