---
id: CVE-2026-68117
title: 'tipc: clear sock->sk on the failed-insert path in tipc_sk_create()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

  When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()
  returns non-zero), its error …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= efa78f2ae363428525fb4981bb63c555ee79f3c7 <
    efebc23e9b29e3e5a9e2127dd066929f7f0d315e
  - >-
    Linux >= 833ecd0eae76eadf81d6d747bb5bc992d1151867 <
    8d6f26d48e61ef34f1921289401dbf36b10816af
  - >-
    Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c <
    82f59aa27f33bd014a7d8739371ab5712d15e33b
  - >-
    Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c <
    b07d87b31631edb6529e6cdcca790a7489d1250d
  - >-
    Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c <
    dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea
  - >-
    Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c <
    5f5a41a48dbf9eda57b67ce23e548602cf7195a6
  - >-
    Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c <
    f9596b1566616a8be0592dbceccb6344a7c6f6bb
  - >-
    Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c <
    ba0533fc163f905fe817cfabdf8ed4058da44800
  - Linux 638fa20b618b2bbcf86da71231624cc82121a036
  - Linux 7bc9e7f70bc57d8f02ffea2a42094281effb15ef
  - Linux ef488669b2652bde5b6ee5a409a5b048a2a50db4
  - Linux 4919d82f7041157a421ca9bf39a78551d5ad8a1b
  - Linux 3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2
  - Linux >= 5.10.132 < 5.10.265
  - Linux >= 5.15.56 < 5.15.216
  - Linux >= 4.9.324 < 4.10
  - Linux >= 4.14.289 < 4.15
  - Linux >= 4.19.253 < 4.20
  - Linux >= 5.4.207 < 5.5
  - Linux >= 5.18.13 < 5.19
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:44:06.454287Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:57.527Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68117'
references:
  - url: 'https://git.kernel.org/stable/c/efebc23e9b29e3e5a9e2127dd066929f7f0d315e'
  - url: 'https://git.kernel.org/stable/c/8d6f26d48e61ef34f1921289401dbf36b10816af'
  - url: 'https://git.kernel.org/stable/c/82f59aa27f33bd014a7d8739371ab5712d15e33b'
  - url: 'https://git.kernel.org/stable/c/b07d87b31631edb6529e6cdcca790a7489d1250d'
  - url: 'https://git.kernel.org/stable/c/dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea'
  - url: 'https://git.kernel.org/stable/c/5f5a41a48dbf9eda57b67ce23e548602cf7195a6'
  - url: 'https://git.kernel.org/stable/c/f9596b1566616a8be0592dbceccb6344a7c6f6bb'
  - url: 'https://git.kernel.org/stable/c/ba0533fc163f905fe817cfabdf8ed4058da44800'
tags:
  - cve.org
epss: 0.00525
epssPercentile: 0.43229
ingestedAt: '2026-10-16T17:24:46.842Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()
returns non-zero), its error path frees the sk with sk_free() but leaves
sock->sk pointing at the freed object:

	if (tipc_sk_insert(tsk)) {
		sk_free(sk);
		pr_warn("Socket create failed; port number exhausted\n");
		return -EINVAL;
	}

This is harmless for plain socket(): the syscall layer clears sock->ops
before releasing, so tipc_release() is never called. It is not harmless
on the accept() path. tipc_accept() creates the pre-allocated child
socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves
new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then
fput()s the new file, so __sock_release() -> tipc_release() runs
lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the
sk_lock spinlock.

tipc_release() already guards this exact "failed accept() releases a
pre-allocated child" case with "if (sk == NULL) return 0;", but the
guard is bypassed because tipc_sk_create() left sock->sk non-NULL
(dangling) rather than NULL.

Clear sock->sk on the failed-insert path so the existing tipc_release()
NULL check fires and the use-after-free is avoided.

The tipc_sk_insert() failure is reached when the per-netns socket
rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M
elements) -- i.e. once a netns holds ~2M TIPC sockets every insert
returns -E2BIG.

  BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
  Write of size 8 at addr ffff8880047cdc38 by task init/1
   lock_sock_nested (net/core/sock.c:3839)
   tipc_release (net/tipc/socket.c:638)
   __sock_release (net/socket.c:710)
   sock_close (net/socket.c:1501)
   __fput (fs/file_table.c:512)
  Allocated by task 1:
   sk_alloc (net/core/sock.c:2308)
   tipc_sk_create (net/tipc/socket.c:487)
   tipc_accept (net/tipc/socket.c:2744)
   do_accept (net/socket.c:2034)
  Freed by task 1:
   __sk_destruct (net/core/sock.c:2391)
   tipc_sk_create (net/tipc/socket.c:504)
   tipc_accept (net/tipc/socket.c:2744)
   do_accept (net/socket.c:2034)

## Affected

- `Linux >= efa78f2ae363428525fb4981bb63c555ee79f3c7 < efebc23e9b29e3e5a9e2127dd066929f7f0d315e`
- `Linux >= 833ecd0eae76eadf81d6d747bb5bc992d1151867 < 8d6f26d48e61ef34f1921289401dbf36b10816af`
- `Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c < 82f59aa27f33bd014a7d8739371ab5712d15e33b`
- `Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c < b07d87b31631edb6529e6cdcca790a7489d1250d`
- `Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c < dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea`
- `Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c < 5f5a41a48dbf9eda57b67ce23e548602cf7195a6`
- `Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c < f9596b1566616a8be0592dbceccb6344a7c6f6bb`
- `Linux >= 00aff3590fc0a73bddd3b743863c14e76fd35c0c < ba0533fc163f905fe817cfabdf8ed4058da44800`
- `Linux 638fa20b618b2bbcf86da71231624cc82121a036`
- `Linux 7bc9e7f70bc57d8f02ffea2a42094281effb15ef`
- `Linux ef488669b2652bde5b6ee5a409a5b048a2a50db4`
- `Linux 4919d82f7041157a421ca9bf39a78551d5ad8a1b`
- `Linux 3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2`
- `Linux >= 5.10.132 < 5.10.265`
- `Linux >= 5.15.56 < 5.15.216`
- `Linux >= 4.9.324 < 4.10`
- `Linux >= 4.14.289 < 4.15`
- `Linux >= 4.19.253 < 4.20`
- `Linux >= 5.4.207 < 5.5`
- `Linux >= 5.18.13 < 5.19`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.