CVE-2026-64543 in Linux
Summary
by MITRE • 07/28/2026
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).
L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period:
BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 <IRQ> tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) </IRQ> Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001)
The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback.
Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away.
Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability described represents a use-after-free condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem, specifically within the tipc_disc_rcv() function. This flaw occurs when a UDP bearer is disabled while an RCU read-side critical section is active, creating a scenario where freed memory is still being accessed. The issue stems from the improper synchronization between the freeing of the discoverer structure and its subsequent dereferencing during packet reception processing. According to CWE-416, this constitutes a classic use-after-free vulnerability that can lead to memory corruption and potential privilege escalation.
The technical implementation flaw manifests when bearer_disable() function invokes tipc_disc_delete() which performs a direct kfree() operation on the b->disc structure without proper RCU grace period handling. However, the tipc_disc_rcv() function continues to dereference this freed pointer within an RX softirq context that operates under rcu_read_lock(), creating a race condition where memory access occurs after deallocation. The UDP bearer implementation defers cleanup operations through the cleanup_bearer() workqueue, eliminating any synchronization guarantees between the freeing of resources and ongoing packet processing activities. This behavior differs from L2 bearers which properly utilize synchronize_net() to ensure resource cleanup completion before subsequent operations.
This vulnerability presents significant operational impact as it can be exploited by unprivileged users within user namespaces due to the TIPCv2 generic netlink family being configured with netnsok attribute and lacking administrative permissions for bearer commands. The attack surface requires specific kernel configuration options including CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP to be enabled, making it relevant primarily in environments where TIPC networking is actively deployed. The memory corruption resulting from this use-after-free condition can potentially lead to system instability, privilege escalation, or denial of service scenarios depending on the execution context and memory layout.
The mitigation strategy involves implementing proper RCU synchronization by modifying the bearer disable mechanism to utilize kfree_rcu() instead of plain kfree() for the discoverer structure. This requires adding an rcu_head member to the struct tipc_discoverer and implementing a dedicated RCU callback function tipc_disc_free_rcu that handles both the discovery structure cleanup and associated skb deallocation. Additionally, the module exit routine must include an rcu_barrier() call after the bearer subsystem teardown to ensure all pending RCU callbacks complete before module unloading occurs. This approach aligns with ATT&CK technique T1068 by addressing privilege escalation pathways through memory corruption vulnerabilities and follows proper kernel memory management practices as defined in the Linux kernel documentation for RCU synchronization mechanisms.
The vulnerability demonstrates a critical gap in the TIPC subsystem's resource management, particularly regarding inter-module synchronization between different network media types. The differential handling between L2 and UDP bearers reveals inconsistent memory lifecycle management approaches within the same subsystem, where one path includes proper synchronization while another does not. This inconsistency creates exploitable conditions that can be leveraged by attackers without elevated privileges, as the TIPC netlink interface provides sufficient access points for triggering the problematic code paths through standard user namespace capabilities. The fix ensures that all resource cleanup operations in the TIPC subsystem properly account for concurrent access patterns and maintain memory safety under all execution contexts including interrupt handlers and RCU read-side critical sections.