CVE-2026-64543

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),

but tipc_disc_rcv() still dereferences b->disc in RX softirq under

rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).

L2 bearers are safe thanks to the synchronize_net() in

tipc_disable_l2_media(), but the UDP bearer defers that call to the

cleanup_bearer() workqueue, so the discoverer is freed with no grace

period:

BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)

Read of size 8 at addr ffff88802348b728 by task poc_tipc/184

<IRQ>

tipc_disc_rcv (net/tipc/discover.c:149)

tipc_rcv (net/tipc/node.c:2126)

tipc_udp_recv (net/tipc/udp_media.c:391)

udp_rcv (net/ipv4/udp.c:2643)

ip_local_deliver_finish (net/ipv4/ip_input.c:241)

</IRQ>

Freed by task 181:

kfree (mm/slub.c:6565)

bearer_disable (net/tipc/bearer.c:418)

tipc_nl_bearer_disabl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References