PT-2026-65218 · Linux · Linux
CVE-2026-64543
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free of the discoverer in tipc disc rcv()
bearer disable() frees b->disc with tipc disc delete()'s plain kfree(),
but tipc disc rcv() still dereferences b->disc in RX softirq under
rcu read lock() (tipc udp recv -> tipc rcv -> tipc disc rcv).
L2 bearers are safe thanks to the synchronize net() in
tipc disable l2 media(), but the UDP bearer defers that call to the
cleanup bearer() workqueue, so the discoverer is freed with no grace
period:
BUG: KASAN: slab-use-after-free in tipc disc rcv (net/tipc/discover.c:149)
Read of size 8 at addr ffff88802348b728 by task poc tipc/184
tipc disc rcv (net/tipc/discover.c:149)
tipc rcv (net/tipc/node.c:2126)
tipc udp recv (net/tipc/udp media.c:391)
udp rcv (net/ipv4/udp.c:2643)
ip local deliver finish (net/ipv4/ip input.c:241)
Freed by task 181:
kfree (mm/slub.c:6565)
bearer disable (net/tipc/bearer.c:418)
tipc nl bearer disable (net/tipc/bearer.c:1001)
The bearer is freed with kfree rcu(); free the discoverer the same way.
Add an rcu head to struct tipc discoverer and free it and its skb from an
RCU callback.
Because the RCU callback (tipc disc free rcu) lives in module text, a
call rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu barrier() to tipc exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.
Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL ADMIN PERM. Needs CONFIG TIPC
and CONFIG TIPC MEDIA UDP.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux