CVE-2026-63801

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done

tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to

crypto_aead_decrypt(req) without taking a reference on the netns, unlike

the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously

(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs

tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the

meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the

per-netns tipc_crypto, and the completion then reads it:

tipc_aead_decrypt_done() dereferences aead->crypto->stats and

aead->crypto->net, and tipc_crypto_rcv_complete() dereferences

aead->crypto->aead[] and the node table -- reading freed memory.

Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):

BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)

Read of size 8 at addr ffff88810

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References