CVE-2026-68117

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()

returns non-zero), its error path frees the sk with sk_free() but leaves

sock->sk pointing at the freed object:

if (tipc_sk_insert(tsk)) {

sk_free(sk);

pr_warn("Socket create failed; port number exhausted\n");

return -EINVAL;

}

This is harmless for plain socket(): the syscall layer clears sock->ops

before releasing, so tipc_release() is never called. It is not harmless

on the accept() path. tipc_accept() creates the pre-allocated child

socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves

new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then

fput()s the new file, so __sock_release() -> tipc_release() runs

lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the

sk_lock spinlock.

tipc_release() already guards this exact

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References