CVE-2026-74609

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: read le->link under the node lock in tipc_node_link_down()

tipc_node_link_down() caches the link pointer before taking n->lock:

struct tipc_link *l = le->link; /* unlocked */

if (!l)

return;

tipc_node_write_lock(n);

if (!tipc_link_is_establishing(l)) { /* deref l */

...

tipc_link_reset(l); /* write into l */

if (delete) {

kfree(l);

le->link = NULL;

The delete=true caller frees that very object under n->lock, so the lock

does not protect the cached pointer against it:

- CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link

supervision timer via tipc_node_timeout(), reads l unlocked and then

dereferences it under n->lock;

- CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -> bearer_disable()

-> tipc_node_delete_links() -> tipc_node_link_down(n, bearer_id, true)

-> kfree(l).

The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers

disable_media()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References