CVE-2026-72299

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: restrict socket queue dumps in enqueue tracepoints

tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is

owned by user context. The spinlock protects the backlog queue in this

path, but it does not serialize against the socket owner consuming or

purging sk_receive_queue.

KASAN reported:

CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014

Call Trace:

<TASK>

dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123

print_report+0xce/0x5b0 mm/kasan/report.c:482

kasan_report+0xc6/0x100 mm/kasan/report.c:597

__asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380

tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73

tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187

tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996

trace_event_raw_event_tipc_sk_class+0x312/0x5a0

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References