CVE-2026-64543: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64543 Overview

CVE-2026-64543 is a use-after-free vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in tipc_disc_rcv() in net/tipc/discover.c, where the discoverer object b->disc can be dereferenced in an RX softirq after bearer_disable() frees it with a plain kfree(). Layer 2 bearers are protected by synchronize_net() in tipc_disable_l2_media(), but the User Datagram Protocol (UDP) bearer defers cleanup to the cleanup_bearer() workqueue, freeing the discoverer without a Read-Copy-Update (RCU) grace period. The issue is reachable from an unprivileged user namespace when CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP are enabled.

Critical Impact
A local unprivileged attacker can trigger memory corruption in kernel context, enabling privilege escalation to root or a full denial of service.

Affected Products

Linux kernel builds with CONFIG_TIPC enabled
Linux kernel builds with CONFIG_TIPC_MEDIA_UDP enabled
Distributions permitting unprivileged user namespaces with TIPC modules loadable

Discovery Timeline

2026-07-27 - CVE-2026-64543 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64543

Vulnerability Analysis

The TIPC discoverer object is allocated per bearer and referenced by tipc_disc_rcv() on the receive path. When userspace disables a bearer through the TIPCv2 generic netlink family, bearer_disable() calls tipc_disc_delete(), which releases b->disc using kfree(). Concurrent RX softirq processing under rcu_read_lock() continues to dereference the same pointer via the call chain tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv.

Kernel Address Sanitizer (KASAN) reports the condition as slab-use-after-free at net/tipc/discover.c:149. The freed 8-byte read occurs from an IRQ context while the freeing task is executing tipc_nl_bearer_disable(). An attacker who wins the race can reclaim the freed slab object and coerce the kernel into dereferencing attacker-controlled data.

Root Cause

The UDP bearer teardown path violates RCU semantics. Although the bearer itself is released with kfree_rcu(), the discoverer sub-object is freed synchronously without a matching grace period. Readers holding rcu_read_lock() therefore observe a dangling pointer.

Attack Vector

The TIPCv2 genl family is netnsok and its bearer commands lack GENL_ADMIN_PERM, so a process inside an unprivileged user namespace can create and disable a UDP bearer while flooding TIPC discovery traffic to race the free. Successful exploitation yields kernel memory corruption with the potential for local privilege escalation.

No public proof-of-concept code is available beyond the KASAN report embedded in the upstream commit messages. See the kernel.org stable commits for the authoritative patch narrative.

Detection Methods for CVE-2026-64543

Indicators of Compromise

KASAN slab-use-after-free reports referencing tipc_disc_rcv in kernel logs
Unexpected kernel oops or general protection faults originating from net/tipc/discover.c
Loading of the tipc and tipc_udp modules on systems that do not operationally require them

Detection Strategies

Enable KASAN on test and canary hosts to surface the race during fuzzing or regression testing
Audit for processes creating user namespaces followed by TIPC bearer netlink operations
Monitor auditd for init_module/finit_module events loading tipc or tipc_udp

Monitoring Recommendations

Collect kernel ring buffer output (dmesg) centrally and alert on TIPC-tagged crashes
Track running kernel versions against the fixed stable commits to identify unpatched hosts
Alert on non-root invocations of unshare(CLONE_NEWUSER) paired with AF_TIPC socket activity

How to Mitigate CVE-2026-64543

Immediate Actions Required

Apply the upstream Linux kernel patch series referenced by commits a0c5fdeb5fa2, b65289e1c3f3, ec7d54d8cc17, 5e215bf1c47f, and 1579342d7113
Blacklist the tipc and tipc_udp modules on systems that do not require inter-process cluster messaging
Disable unprivileged user namespaces where operationally feasible via kernel.unprivileged_userns_clone=0

Patch Information

The fix converts the discoverer release path to RCU. A new rcu_head is added to struct tipc_discoverer, and the discoverer plus its socket buffer are freed from an RCU callback (tipc_disc_free_rcu) using call_rcu(). An rcu_barrier() is added to tipc_exit() after bearer subsystem teardown so pending callbacks complete before the TIPC module text is unloaded. Patches are available from the kernel.org stable tree.

Workarounds

Prevent tipc module autoload by adding install tipc /bin/true to /etc/modprobe.d/
Restrict TIPC netlink access with seccomp or Linux Security Modules on multi-tenant hosts
Set kernel.unprivileged_userns_clone=0 to remove the unprivileged reachability path

bash

# Configuration example: block TIPC modules and unprivileged user namespaces
echo 'install tipc /bin/true' | sudo tee /etc/modprobe.d/blacklist-tipc.conf
echo 'install tipc_udp /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-tipc.conf
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system