---
id: CVE-2026-99246
title: 'tipc: protect node reset trace dump with node lock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: protect node reset trace dump with node lock

  The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
  node's link entries. Unlike the other node e…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    c8b72ca0918e95f708f67c8b3e69b05290f2b6d2
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    6e492cb98ca69cc1145175e23e22e3b84da7f26d
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    7bb6a35bd6d69019539d8782fb590fd2aa8a3236
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    6abd93d01b0f495f29201925a5ee8e6a583c4044
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    a6101d62ccfa153db8c218ce59362b8e0316fd4f
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    fa8c78c0e49aa11fae116fd841e41aa8f2d68751
  - >-
    Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b <
    dddf197f29ba5e47a476dde82bf542ca2e0d5e5e
  - Linux 5.0
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:14:37.365Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99246'
references:
  - url: 'https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2'
  - url: 'https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d'
  - url: 'https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236'
  - url: 'https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044'
  - url: 'https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f'
  - url: 'https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b'
  - url: 'https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751'
  - url: 'https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e'
tags:
  - cve.org
epss: 0.00443
epssPercentile: 0.38631
ingestedAt: '2026-11-05T20:33:06.394Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: protect node reset trace dump with node lock

The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.

This permits bearer teardown to free a link while the trace callback is
dumping it:

  CPU 0                                CPU 1
  trace_tipc_node_reset_links()
    tipc_node_dump()
      l = n->links[0].link
                                       tipc_node_write_lock()
                                       kfree(l)
                                       n->links[0].link = NULL
                                       tipc_node_write_unlock()
      tipc_link_dump(l)

tipc_link_dump() then dereferences the stale pointer. KASAN reported:

  BUG: KASAN: slab-use-after-free in tipc_link_dump
  Read of size 4 by task poc/115
  Call Trace:
   tipc_link_dump+0x10cb/0x16b0
   tipc_node_dump+0x4bb/0x740
   trace_event_raw_event_tipc_node_class+0x258/0x360
   tipc_node_reset_links+0x14d/0x1a0
   tipc_rcv+0x13f5/0x3030
   tipc_udp_recv+0x4e3/0x670
  Allocated by task 0:
   tipc_link_create+0x1e1/0x1020
   tipc_node_check_dest+0x7d2/0x11a0
   tipc_disc_rcv+0xdbf/0x1430
  Freed by task 89:
   kfree+0x131/0x3c0
   tipc_node_link_down+0x267/0x4b0
   tipc_node_delete_links+0xec/0x160
   bearer_disable+0x107/0x260

Take the node write lock around the trace event. This serializes the
dump against tipc_node_link_down(delete=true), which frees the link
under the same write lock.

## Affected

- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < c8b72ca0918e95f708f67c8b3e69b05290f2b6d2`
- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < 6e492cb98ca69cc1145175e23e22e3b84da7f26d`
- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < 7bb6a35bd6d69019539d8782fb590fd2aa8a3236`
- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < 6abd93d01b0f495f29201925a5ee8e6a583c4044`
- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < a6101d62ccfa153db8c218ce59362b8e0316fd4f`
- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b`
- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < fa8c78c0e49aa11fae116fd841e41aa8f2d68751`
- `Linux >= eb18a510b5cd4daeb9736ad8db57a9fc49db185b < dddf197f29ba5e47a476dde82bf542ca2e0d5e5e`
- `Linux 5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.