Use-After-Free Vulnerability in Linux Kernel TCP/IP Stack

CVE-2026-64543

What is CVE-2026-64543?

A use-after-free vulnerability exists in the Linux kernel's TIPC (Transparent Inter-Process Communication) implementation. Specifically, the problem arises in the 'tipc_disc_rcv' function where the discoverer structure can be dereferenced after being freed. This is particularly dangerous as it allows unprivileged users to exploit it due to insufficient permission checks in the TIPC's UDP bearer commands. The defect results from the 'bearer_disable' function freeing resources without ensuring there are no ongoing references to those resources, leading to potential memory access violations. Even though L2 bearers remain safe using proper cleanup mechanisms, the UDP bearer relies on a workqueue which delays cleanup, making it susceptible to attacks. It's crucial to ensure that the RCU (Read-Copy-Update) mechanisms are correctly implemented, including the addition of an 'rcu_head' in the structure to facilitate safe memory management.

References