{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64543", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.795Z", "datePublished": "2026-07-27T20:10:35.565Z", "dateUpdated": "2026-07-27T20:10:35.565Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-27T20:10:35.565Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free of the discoverer in tipc_disc_rcv()\n\nbearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),\nbut tipc_disc_rcv() still dereferences b->disc in RX softirq under\nrcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).\n\nL2 bearers are safe thanks to the synchronize_net() in\ntipc_disable_l2_media(), but the UDP bearer defers that call to the\ncleanup_bearer() workqueue, so the discoverer is freed with no grace\nperiod:\n\n BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)\n Read of size 8 at addr ffff88802348b728 by task poc_tipc/184\n <IRQ>\n tipc_disc_rcv (net/tipc/discover.c:149)\n tipc_rcv (net/tipc/node.c:2126)\n tipc_udp_recv (net/tipc/udp_media.c:391)\n udp_rcv (net/ipv4/udp.c:2643)\n ip_local_deliver_finish (net/ipv4/ip_input.c:241)\n </IRQ>\n Freed by task 181:\n kfree (mm/slub.c:6565)\n bearer_disable (net/tipc/bearer.c:418)\n tipc_nl_bearer_disable (net/tipc/bearer.c:1001)\n\nThe bearer is freed with kfree_rcu(); free the discoverer the same way.\nAdd an rcu_head to struct tipc_discoverer and free it and its skb from an\nRCU callback.\n\nBecause the RCU callback (tipc_disc_free_rcu) lives in module text, a\ncall_rcu() that is still pending when the tipc module is unloaded would\ninvoke a freed function. Add an rcu_barrier() to tipc_exit() after the\nbearer subsystem has been torn down, so all pending discoverer callbacks\nhave run before the module text goes away.\n\nReachable from an unprivileged user namespace: the TIPCv2 genl family is\nnetnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC\nand CONFIG_TIPC_MEDIA_UDP."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/core.c", "net/tipc/discover.c"], "versions": [{"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "lessThan": "5e215bf1c47fdddf8203a0fe80a0ed594065f101", "status": "affected", "versionType": "git"}, {"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "lessThan": "ec7d54d8cc1723921d671e3272b427c96366506f", "status": "affected", "versionType": "git"}, {"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "lessThan": "a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2", "status": "affected", "versionType": "git"}, {"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "lessThan": "b65289e1c3f352a9f92c6e19713ddd647e033253", "status": "affected", "versionType": "git"}, {"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "lessThan": "1579342d71133da7f00daa02c75cebec7372097b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/core.c", "net/tipc/discover.c"], "versions": [{"version": "4.17", "status": "affected"}, {"version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101"}, {"url": "https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f"}, {"url": "https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2"}, {"url": "https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253"}, {"url": "https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b"}], "title": "tipc: fix use-after-free of the discoverer in tipc_disc_rcv()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,5e215bf1c47fdddf8203a0fe80a0ed594065f101)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,ec7d54d8cc1723921d671e3272b427c96366506f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,b65289e1c3f352a9f92c6e19713ddd647e033253)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[25b0b9c4e835ffaa65b61c3efe2e28acf84d0259,1579342d71133da7f00daa02c75cebec7372097b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-28T04:00:06.381913+00:00", "updated": "2026-07-28T04:00:06.381944+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}