{"id":"CVE-2026-63801","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix slab-use-after-free Read in tipc_aead_decrypt_done\n\ntipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to\ncrypto_aead_decrypt(req) without taking a re…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix slab-use-after-free Read in tipc_aead_decrypt_done\n\ntipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to\ncrypto_aead_decrypt(req) without taking a re…","severity":"high","published":"2026-07-19","updated":"2026-07-19","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63801","references":[{"url":"https://git.kernel.org/stable/c/0a780653b2a7569a7af9be7d0b00b1251baca63a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/171d31245d11bf84836fad3b394cb465a4d008ec","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1eea5e1820a2f5164d706bd1277bc97ff31ce32d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2d1f21419ec121232c916d3a3fc9b6766473a0e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bda3348872a2ef0d19f2df6aa8cb5025adce2f20","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dca7713fe044a2067387948557ea099056e1679e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e18769616fd5a90ec1e12aabbba544c488284292","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaca7dae02fab70c8d223cffe03cec1b93249ce2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63801.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-63801"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502254"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63801"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63801"},{"url":"https://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63801-f5e2@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:66325"},{"url":"https://access.redhat.com/errata/RHSA-2026:66324"},{"url":"https://access.redhat.com/errata/RHSA-2026:67150"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-07-20T01:35:22.897Z","epss":0.00513,"epssPercentile":0.42735,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9","enterprise_linux_baseos_v_8","enterprise_linux_crb_v_8","enterprise_linux_nfv_v_8","enterprise_linux_rt_v_8"],"patched":["enterprise_linux_baseos_v_8","enterprise_linux_crb_v_8","enterprise_linux_nfv_v_8","enterprise_linux_rt_v_8"],"cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":["CWE-825"],"slug":"CVE-2026-63801","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix slab-use-after-free Read in tipc_aead_decrypt_done\n\ntipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to\ncrypto_aead_decrypt(req) without taking a reference on the netns, unlike\nthe encrypt path. When crypto_aead_decrypt() is offloaded asynchronously\n(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs\ntipc_aead_decrypt_done() later. If the bearer's netns is torn down in the\nmeantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the\nper-netns tipc_crypto, and the completion then reads it:\ntipc_aead_decrypt_done() dereferences aead->crypto->stats and\naead->crypto->net, and tipc_crypto_rcv_complete() dereferences\naead->crypto->aead[] and the node table -- reading freed memory.\n\nDecoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):\n\n  BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n  Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51\n  Workqueue: events_unbound\n  Call Trace:\n   tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n   process_one_work (kernel/workqueue.c:3314)\n   worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n  Allocated by task 169:\n   __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n   tipc_crypto_start (net/tipc/crypto.c:1502)\n   tipc_init_net (net/tipc/core.c:72)\n   ops_init (net/core/net_namespace.c:137)\n   setup_net (net/core/net_namespace.c:446)\n   copy_net_ns (net/core/net_namespace.c:579)\n   create_new_namespaces (kernel/nsproxy.c:132)\n   __x64_sys_unshare (kernel/fork.c:3316)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n  Freed by task 8:\n   kfree (mm/slub.c:6566)\n   tipc_exit_net (net/tipc/core.c:119)\n   cleanup_net (net/core/net_namespace.c:704)\n   process_one_work (kernel/workqueue.c:3314)\n   kthread (kernel/kthread.c:436)\n\nThis is the same class of bug that commit e279024617134 (\"net/tipc: fix\nslab-use-after-free Read in tipc_aead_encrypt_done\") fixed for the encrypt\nside. The encrypt path takes maybe_get_net(aead->crypto->net) before\ncrypto_aead_encrypt() and drops it with put_net() on the synchronous\nreturn paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY\nreturn keeps the reference for the async callback to release. The decrypt\npath was left without the equivalent guard.\n\nMirror the encrypt-side fix on the decrypt path: take a net reference\nbefore crypto_aead_decrypt() (failing with -ENODEV and the matching\nbearer put if it cannot be acquired), keep it across the\n-EINPROGRESS/-EBUSY async return, and drop it with put_net() on the\nsynchronous success/error return and at the end of\ntipc_aead_decrypt_done().\n\nReproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is\nflooded with crafted encrypted frames from an unknown peer (driving the\ncluster-key decrypt path) while the bearer's netns is repeatedly torn\ndown. The completion must run asynchronously to outlive\ntipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts\nsynchronously, so the async path was exercised via cryptd offload. The\nunguarded aead->crypto dereference in tipc_aead_decrypt_done() is the\nunpatched upstream path; tipc_aead_decrypt() still lacks\nmaybe_get_net(aead->crypto->net), so the completion can outlive the free\non any config where crypto_aead_decrypt() goes async.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:66325** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66325)\n- **RHSA-2026:66324** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66324)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63801.json)\n- **RHSA-2026:67150** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67150)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201852,"id":"CVE-2026-63801","ts":1789399864106,"field":"cvss","old":null,"new":"7"},{"seq":201851,"id":"CVE-2026-63801","ts":1789399864106,"field":"severity","old":"none","new":"high"},{"seq":200582,"id":"CVE-2026-63801","ts":1789397447946,"field":"cvss","old":"7","new":null},{"seq":200581,"id":"CVE-2026-63801","ts":1789397447946,"field":"severity","old":"high","new":"none"},{"seq":198499,"id":"CVE-2026-63801","ts":1789392043522,"field":"cvss","old":null,"new":"7"},{"seq":198498,"id":"CVE-2026-63801","ts":1789392043522,"field":"severity","old":"none","new":"high"},{"seq":196292,"id":"CVE-2026-63801","ts":1789383651226,"field":"cvss","old":"7","new":null},{"seq":196291,"id":"CVE-2026-63801","ts":1789383651226,"field":"severity","old":"high","new":"none"},{"seq":195221,"id":"CVE-2026-63801","ts":1789380507574,"field":"cvss","old":null,"new":"7"},{"seq":195220,"id":"CVE-2026-63801","ts":1789380507574,"field":"severity","old":"none","new":"high"},{"seq":194008,"id":"CVE-2026-63801","ts":1789378588315,"field":"cvss","old":"7","new":null},{"seq":194007,"id":"CVE-2026-63801","ts":1789378588315,"field":"severity","old":"high","new":"none"},{"seq":192795,"id":"CVE-2026-63801","ts":1789376437687,"field":"cvss","old":null,"new":"7"},{"seq":192794,"id":"CVE-2026-63801","ts":1789376437687,"field":"severity","old":"none","new":"high"},{"seq":191582,"id":"CVE-2026-63801","ts":1789373501053,"field":"cvss","old":"7","new":null},{"seq":191581,"id":"CVE-2026-63801","ts":1789373501053,"field":"severity","old":"high","new":"none"},{"seq":190367,"id":"CVE-2026-63801","ts":1789369386383,"field":"cvss","old":null,"new":"7"},{"seq":190366,"id":"CVE-2026-63801","ts":1789369386383,"field":"severity","old":"none","new":"high"},{"seq":189154,"id":"CVE-2026-63801","ts":1789368306886,"field":"cvss","old":"7","new":null},{"seq":189153,"id":"CVE-2026-63801","ts":1789368306886,"field":"severity","old":"high","new":"none"},{"seq":187937,"id":"CVE-2026-63801","ts":1789365178110,"field":"cvss","old":null,"new":"7"},{"seq":187936,"id":"CVE-2026-63801","ts":1789365178110,"field":"severity","old":"none","new":"high"},{"seq":186724,"id":"CVE-2026-63801","ts":1789363349015,"field":"cvss","old":"7","new":null},{"seq":186723,"id":"CVE-2026-63801","ts":1789363349015,"field":"severity","old":"high","new":"none"},{"seq":185510,"id":"CVE-2026-63801","ts":1789361157203,"field":"cvss","old":null,"new":"7"},{"seq":185509,"id":"CVE-2026-63801","ts":1789361157203,"field":"severity","old":"none","new":"high"},{"seq":184297,"id":"CVE-2026-63801","ts":1789358219500,"field":"cvss","old":"7","new":null},{"seq":184296,"id":"CVE-2026-63801","ts":1789358219500,"field":"severity","old":"high","new":"none"},{"seq":182548,"id":"CVE-2026-63801","ts":1789354253869,"field":"cvss","old":null,"new":"7"},{"seq":182547,"id":"CVE-2026-63801","ts":1789354253869,"field":"severity","old":"none","new":"high"},{"seq":181341,"id":"CVE-2026-63801","ts":1789353205541,"field":"cvss","old":"7","new":null},{"seq":181340,"id":"CVE-2026-63801","ts":1789353205541,"field":"severity","old":"high","new":"none"},{"seq":180134,"id":"CVE-2026-63801","ts":1789350206934,"field":"cvss","old":null,"new":"7"},{"seq":180133,"id":"CVE-2026-63801","ts":1789350206934,"field":"severity","old":"none","new":"high"},{"seq":178927,"id":"CVE-2026-63801","ts":1789348167035,"field":"cvss","old":"7","new":null},{"seq":178926,"id":"CVE-2026-63801","ts":1789348167035,"field":"severity","old":"high","new":"none"},{"seq":177720,"id":"CVE-2026-63801","ts":1789346312953,"field":"cvss","old":null,"new":"7"},{"seq":177719,"id":"CVE-2026-63801","ts":1789346312953,"field":"severity","old":"none","new":"high"},{"seq":176513,"id":"CVE-2026-63801","ts":1789343089096,"field":"cvss","old":"7","new":null},{"seq":176512,"id":"CVE-2026-63801","ts":1789343089096,"field":"severity","old":"high","new":"none"},{"seq":174630,"id":"CVE-2026-63801","ts":1789334820591,"field":"cvss","old":null,"new":"7"},{"seq":174629,"id":"CVE-2026-63801","ts":1789334820591,"field":"severity","old":"none","new":"high"},{"seq":173425,"id":"CVE-2026-63801","ts":1789333550093,"field":"cvss","old":"7","new":null},{"seq":173424,"id":"CVE-2026-63801","ts":1789333550093,"field":"severity","old":"high","new":"none"},{"seq":172239,"id":"CVE-2026-63801","ts":1789331038102,"field":"cvss","old":null,"new":"7"},{"seq":172238,"id":"CVE-2026-63801","ts":1789331038102,"field":"severity","old":"none","new":"high"},{"seq":171053,"id":"CVE-2026-63801","ts":1789328664733,"field":"cvss","old":"7","new":null},{"seq":171052,"id":"CVE-2026-63801","ts":1789328664733,"field":"severity","old":"high","new":"none"},{"seq":169848,"id":"CVE-2026-63801","ts":1789327089608,"field":"cvss","old":null,"new":"7"},{"seq":169847,"id":"CVE-2026-63801","ts":1789327089608,"field":"severity","old":"none","new":"high"}]}