# CVE-2026-99246: tipc: protect node reset trace dump with node lock

Status: published. Published: 2026-11-03. Updated: 2026-11-03.

In the Linux kernel, the following vulnerability has been resolved:

tipc: protect node reset trace dump with node lock

The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.

This permits bearer teardown to free a link while the trace callback is
dumping it:

  CPU 0                                CPU 1
  trace_tipc_node_reset_links()
    tipc_node_dump()
      l = n->links[0].link
                                       tipc_node_write_lock()
                                       kfree(l)
                                       n->links[0].link = NULL
                                       tipc_node_write_unlock()
      tipc_link_dump(l)

tipc_link_dump() then dereferences the stale pointer. KASAN reported:

  BUG: KASAN: slab-use-after-free in tipc_link_dump
  Read of size 4 by task poc/115
  Call Trace:
   tipc_link_dump+0x10cb/0x16b0
   tipc_node_dump+0x4bb/0x740
   trace_event_raw_event_tipc_node_class+0x258/0x360
   tipc_node_reset_links+0x14d/0x1a0
   tipc_rcv+0x13f5/0x3030
   tipc_udp_recv+0x4e3/0x670
  Allocated by task 0:
   tipc_link_create+0x1e1/0x1020
   tipc_node_check_dest+0x7d2/0x11a0
   tipc_disc_rcv+0xdbf/0x1430
  Freed by task 89:
   kfree+0x131/0x3c0
   tipc_node_link_down+0x267/0x4b0
   tipc_node_delete_links+0xec/0x160
   bearer_disable+0x107/0x260

Take the node write lock around the trace event. This serializes the
dump against tipc_node_link_down(delete=true), which frees the link
under the same write lock.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < c8b72ca0918e95f708f67c8b3e69b05290f2b6d2 (affected, git); ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < 6e492cb98ca69cc1145175e23e22e3b84da7f26d (affected, git); ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < 7bb6a35bd6d69019539d8782fb590fd2aa8a3236 (affected, git); ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < 6abd93d01b0f495f29201925a5ee8e6a583c4044 (affected, git); ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < a6101d62ccfa153db8c218ce59362b8e0316fd4f (affected, git); ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b (affected, git); ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < fa8c78c0e49aa11fae116fd841e41aa8f2d68751 (affected, git); ≥ eb18a510b5cd4daeb9736ad8db57a9fc49db185b; < dddf197f29ba5e47a476dde82bf542ca2e0d5e5e (affected, git). Source: CNA: Linux
- Linux / Linux: 5.0 (affected); ≥ 0; < 5.0 (unaffected, semver); ≥ 5.10.273; ≤ 5.10.* (unaffected, semver); ≥ 5.15.224; ≤ 5.15.* (unaffected, semver); ≥ 6.1.191; ≤ 6.1.* (unaffected, semver); ≥ 6.6.161; ≤ 6.6.* (unaffected, semver); ≥ 6.12.115; ≤ 6.12.* (unaffected, semver); ≥ 6.18.59; ≤ 6.18.* (unaffected, semver); ≥ 7.2.13; ≤ 7.2.* (unaffected, semver); ≥ 7.3; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2 (CNA: Linux)

- https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d (CNA: Linux)

- https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236 (CNA: Linux)

- https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044 (CNA: Linux)

- https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f (CNA: Linux)

- https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b (CNA: Linux)

- https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751 (CNA: Linux)

- https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-99246; retrieved 2026-11-03; source updated 2026-11-03

Revision: 17125a81294824cd4d305f24147578b29d00b7aa9c1c2a6044452578ab0199a3

Canonical: https://y2.dev/cve/CVE-2026-99246

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.