CVE-2026-99053 — tipc: hold a reference to nodes found by link name
In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers then lock and access the node, racing with timer-driven cleanup of a down peer. Generic netlink serialization does not exclude the node timer. The following interleaving can leave a handler using a freed node: CPU 0: find the node under RCU and release the node read lock CPU 1: tipc_node_timeout() clears the links and unlinks the down node CPU 1: drop the list and timer references, queuing tipc_node_free() CPU 0: leave the RCU read-side critical section CPU 1: complete the grace period and free the node CPU 0: acquire the node lock through the stale pointer LINK_SET also uses the node's media address after releasing the node lock, when passing queued packets to tipc_bearer_xmit(). KASAN on v7.3-rc5 reported: BUG: KASAN: slab-use-after-free in _raw_read_lock_bh Write of size 4 at addr ffff88807e06f008 by task poc/92 Call Trace: _raw_read_lock_bh kernel/locking/spinlock.c:287 tipc_nl_node_set_link net/tipc/node.c:2475 genl_family_rcv_msg_doit net/netlink/genetlink.c:1114 genl_rcv_msg net/netlink/genetlink.c:1209 netlink_rcv_skb net/netlink/af_netlink.c:2575 Allocated by task 0: tipc_node_create net/tipc/node.c:539 tipc_node_check_dest net/tipc/node.c:1196 tipc_disc_rcv net/tipc/discover.c:252 Freed by task 92: kfree mm/slub.c:6801 rcu_core kernel/rcu/tree.c:2919 Last potentially related work creation: __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181 tipc_node_timeout net/tipc/node.c:814 Acquire a reference to the selected node with kref_get_unless_zero() before leaving RCU, returning NULL if the node has already been released. Release that reference on every caller exit after the last node access, including transmission in LINK_SET. Keep the existing link lookup order and locking so concurrent link removal still takes the existing error paths.
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- EPSS 0.2% (30-day exploitation probability)+1
- Technical severity (high)+6
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
- No fix documented in the sources: reduce exposure and monitor the vendor advisory.
- Search available logs for exploit probes, errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Linux | Linux |
≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < b60259d4047fbb735476c729dcf9306a038b6110≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < f17e70206a1e763fcca2578a8db3c4eed0f843a9≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < 1428c5f1d346a2e1ac9156713975a72246957009≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < 3c3b308ee6e25729a6cf09b69cdd0e093220d40b≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < 17e73bae400f6a434dc006e3bee92c94cf781954version 4.19≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < 384edc67201f8561b7de952647b923f0524b1f36≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < 5b7e58e8be90f4e8530e7a60372d003dfa7fd666 and 1 more≥ 6a939f365bdb03a74b4617bdb4402fc08da088b9 and < 92f3b3368722631e933a4db0cf8bd578ed08cd9c |
Vulnerable | CVE Program (cve.org) e CISA ADP |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 7.8 | CVSS 3.1 | High | 1.8 | 5.9 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database |
| 7.8 | CVSS 3.1 | High | — | — | GitHub, Inc. via GitHub Security Advisories |
| 7.8 | CVSS 3.1 | High | — | — | Linux via CVE Program (cve.org) e CISA ADP |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score shown at the top: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) EPSS over time FIRST
Oct 24, 2026 → Oct 30, 2026 · 7 reading(s) · max 0.21%
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.
Timeline
What happened to this CVE, newest first.
- 2026
- Affected products added · linux/linux
- CVSS changed · 7.8
- Record published
- Affected products added · linux/linux
- Source status changed · → Received
- Record created in this database
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 3× References added · Oct 23, 2026 – Oct 30, 2026
- 1× Official description updated · Oct 23, 2026 – Oct 23, 2026
References
10 on the record
- nvd.nist.gov/vuln/detail/CVE-2026-99053
- git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009
- git.kernel.org/stable/c/5b7e58e8be90f4e8530e7a60372d003dfa7fd666
- git.kernel.org/stable/c/92f3b3368722631e933a4db0cf8bd578ed08cd9c
- git.kernel.org/stable/c/384edc67201f8561b7de952647b923f0524b1f36
- git.kernel.org/stable/c/3c3b308ee6e25729a6cf09b69cdd0e093220d40b
- git.kernel.org/stable/c/17e73bae400f6a434dc006e3bee92c94cf781954
- git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9
- git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110
- github.com/advisories/GHSA-j7x4-wphj-g9x9
Elsewhere on this site
Related CVEs (same products)
- Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 2d
- Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 2d
- Unknown CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock 2d
- Unknown CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation 2d
- Unknown CVE-2026-99209 drm/xe: skip eviction of a BO with no resource 2d
- Unknown CVE-2026-99210 accel/rocket: clear rdev on device init failure 2d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No fixed version, patch or mitigation documented.
- No CISA SSVC assessment.
- No CWE classification.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2026-99053 is "tipc: hold a reference to nodes found by link name", rated High. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 7.8 describes technical severity. EPSS 0.17% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.