---
id: CVE-2026-64543
title: 'tipc: fix use-after-free of the discoverer in tipc_disc_rcv()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

  bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
  but tipc_disc_rcv() still derefer…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    380413cdfd29fb9fa486c82889132b680c4983c5
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    f05b3f4c78370469286879c765f5a1dd39dbcd32
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    4da2ac7749411971e1b222b992da5a172ce45f98
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    5e215bf1c47fdddf8203a0fe80a0ed594065f101
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    ec7d54d8cc1723921d671e3272b427c96366506f
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    b65289e1c3f352a9f92c6e19713ddd647e033253
  - >-
    Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 <
    1579342d71133da7f00daa02c75cebec7372097b
  - Linux 4.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:42:12.338756Z'
published: '2026-07-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:51.300Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64543'
references:
  - url: 'https://git.kernel.org/stable/c/380413cdfd29fb9fa486c82889132b680c4983c5'
  - url: 'https://git.kernel.org/stable/c/f05b3f4c78370469286879c765f5a1dd39dbcd32'
  - url: 'https://git.kernel.org/stable/c/4da2ac7749411971e1b222b992da5a172ce45f98'
  - url: 'https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101'
  - url: 'https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f'
  - url: 'https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2'
  - url: 'https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253'
  - url: 'https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02035
ingestedAt: '2026-10-16T17:24:46.833Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
but tipc_disc_rcv() still dereferences b->disc in RX softirq under
rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).

L2 bearers are safe thanks to the synchronize_net() in
tipc_disable_l2_media(), but the UDP bearer defers that call to the
cleanup_bearer() workqueue, so the discoverer is freed with no grace
period:

 BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)
 Read of size 8 at addr ffff88802348b728 by task poc_tipc/184
 <IRQ>
  tipc_disc_rcv (net/tipc/discover.c:149)
  tipc_rcv (net/tipc/node.c:2126)
  tipc_udp_recv (net/tipc/udp_media.c:391)
  udp_rcv (net/ipv4/udp.c:2643)
  ip_local_deliver_finish (net/ipv4/ip_input.c:241)
 </IRQ>
 Freed by task 181:
  kfree (mm/slub.c:6565)
  bearer_disable (net/tipc/bearer.c:418)
  tipc_nl_bearer_disable (net/tipc/bearer.c:1001)

The bearer is freed with kfree_rcu(); free the discoverer the same way.
Add an rcu_head to struct tipc_discoverer and free it and its skb from an
RCU callback.

Because the RCU callback (tipc_disc_free_rcu) lives in module text, a
call_rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu_barrier() to tipc_exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.

Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC
and CONFIG_TIPC_MEDIA_UDP.

## Affected

- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < 380413cdfd29fb9fa486c82889132b680c4983c5`
- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < f05b3f4c78370469286879c765f5a1dd39dbcd32`
- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < 4da2ac7749411971e1b222b992da5a172ce45f98`
- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < 5e215bf1c47fdddf8203a0fe80a0ed594065f101`
- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < ec7d54d8cc1723921d671e3272b427c96366506f`
- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2`
- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < b65289e1c3f352a9f92c6e19713ddd647e033253`
- `Linux >= 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 < 1579342d71133da7f00daa02c75cebec7372097b`
- `Linux 4.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.