CVE-2026-64543

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),

but tipc_disc_rcv() still dereferences b->disc in RX softirq under

rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).

L2 bearers are safe thanks to the synchronize_net() in

tipc_disable_l2_media(), but the UDP bearer defers that call to the

cleanup_bearer() workqueue, so the discoverer is freed with no grace

period:

BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)

Read of size 8 at addr ffff88802348b728 by task poc_tipc/184

<IRQ>

tipc_disc_rcv (net/tipc/discover.c:149)

tipc_rcv (net/tipc/node.c:2126)

tipc_udp_recv (net/tipc/udp_media.c:391)

udp_rcv (net/ipv4/udp.c:2643)

ip_local_deliver_finish (net/ipv4/ip_input.c:241)

</IRQ>

Freed by task 181:

kfree (mm/slub.c:6565)

bearer_disable (net/tipc/bearer.c:418)

tipc_nl_bearer_disable (net/tipc/bearer.c:1001)

The bearer is freed with kfree_rcu(); free the discoverer the same way.

Add an rcu_head to struct tipc_discoverer and free it and its skb from an

RCU callback.

Because the RCU callback (tipc_disc_free_rcu) lives in module text, a

call_rcu() that is still pending when the tipc module is unloaded would

invoke a freed function. Add an rcu_barrier() to tipc_exit() after the

bearer subsystem has been torn down, so all pending discoverer callbacks

have run before the module text goes away.

Reachable from an unprivileged user namespace: the TIPCv2 genl family is

netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC

and CONFIG_TIPC_MEDIA_UDP.