{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-64543", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-64543", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-07-27T20:10:35.565Z", "updatedAt": "2026-10-19T20:48:39.735Z", "importedAt": "2026-10-24T01:58:25.636Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "tipc: fix use-after-free of the discoverer in tipc_disc_rcv()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free of the discoverer in tipc_disc_rcv()\n\nbearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),\nbut tipc_disc_rcv() still dereferences b->disc in RX softirq under\nrcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).\n\nL2 bearers are safe thanks to the synchronize_net() in\ntipc_disable_l2_media(), but the UDP bearer defers that call to the\ncleanup_bearer() workqueue, so the discoverer is freed with no grace\nperiod:\n\n BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)\n Read of size 8 at addr ffff88802348b728 by task poc_tipc/184\n \n tipc_disc_rcv (net/tipc/discover.c:149)\n tipc_rcv (net/tipc/node.c:2126)\n tipc_udp_recv (net/tipc/udp_media.c:391)\n udp_rcv (net/ipv4/udp.c:2643)\n ip_local_deliver_finish (net/ipv4/ip_input.c:241)\n \n Freed by task 181:\n kfree (mm/slub.c:6565)\n bearer_disable (net/tipc/bearer.c:418)\n tipc_nl_bearer_disable (net/tipc/bearer.c:1001)\n\nThe bearer is freed with kfree_rcu(); free the discoverer the same way.\nAdd an rcu_head to struct tipc_discoverer and free it and its skb from an\nRCU callback.\n\nBecause the RCU callback (tipc_disc_free_rcu) lives in module text, a\ncall_rcu() that is still pending when the tipc module is unloaded would\ninvoke a freed function. Add an rcu_barrier() to tipc_exit() after the\nbearer subsystem has been torn down, so all pending discoverer callbacks\nhave run before the module text goes away.\n\nReachable from an unprivileged user namespace: the TIPCv2 genl family is\nnetnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC\nand CONFIG_TIPC_MEDIA_UDP.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "380413cdfd29fb9fa486c82889132b680c4983c5" }, { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "f05b3f4c78370469286879c765f5a1dd39dbcd32" }, { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "4da2ac7749411971e1b222b992da5a172ce45f98" }, { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "5e215bf1c47fdddf8203a0fe80a0ed594065f101" }, { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "ec7d54d8cc1723921d671e3272b427c96366506f" }, { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2" }, { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "b65289e1c3f352a9f92c6e19713ddd647e033253" }, { "version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259", "status": "affected", "versionType": "git", "lessThan": "1579342d71133da7f00daa02c75cebec7372097b" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.17" }, { "version": "5.10.265", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.216", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.183", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.145", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.97", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.40", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.1.5", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.1.*" }, { "version": "7.2", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }