CVE-2026-99246
Description
A flaw was found in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. A race condition occurs when tracing link reset events without proper locking, which can cause link data to be freed while it is actively being accessed. An unauthenticated remote attacker could exploit this use-after-free vulnerability by sending network traffic that triggers link resets during connection teardown. Successful exploitation could lead to arbitrary code execution or a Denial of Service (DoS) through a system crash.
Statement
This vulnerability is rated as Important severity because successful exploitation may permit an unauthenticated remote attacker to trigger kernel memory corruption or an immediate system crash. The TIPC kernel module is not loaded by default across Red Hat Enterprise Linux installations and must be explicitly configured. Furthermore, triggering the condition requires precise timing between link reset tracing and bearer teardown operations, resulting in high attack complexity.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to acquire the TIPC node write lock across trace_tipc_node_reset_links or disable TIPC node reset tracepoints to prevent unlocked link dumping: upgrade to the corresponding fixed Red Hat builds, which acquire the node write lock around trace_tipc_node_reset_links to serialize trace dumping against link deletion, closing crafted TIPC network traffic triggering link resets during concurrent bearer teardown. Until patched, this is only a concern on Linux systems with the TIPC module and bearer enabled and node reset tracepoints actively monitored — Linux systems without the TIPC module loaded or active bearers are unaffected — so disable active TIPC node reset tracepoints, restrict network access to TIPC bearer interfaces, and avoid concurrent bearer teardown operations. As a compensating measure, enable KASAN or HWASan to detect kernel slab use-after-free reads when stale link pointers are accessed, enforce NX/XD non-executable memory permissions on kernel heap and data pages to prevent shellcode execution, enable KASLR to randomize kernel base addresses and impede code execution following stale pointer dereferencing, enable SMEP to block the kernel from executing userspace memory pages during exploit payload delivery, enable SMAP to block supervisor access to userspace memory structures during privilege escalation attempts, and enforce Control Flow Integrity and Shadow Call Stack to prevent forward-edge indirect branch redirection in kernel space. These controls limit blast radius and contain exploitation, but they do not fix the underlying race condition use-after-free defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
