CVE-2026-72299

A flaw was found in the TIPC (Transparent Inter-Process Communication) component of the Linux kernel. When tipc_sk_enqueue() tracepoints are active and a socket is owned by a user, the system may attempt to access already freed or dequeued socket buffers. This can lead to a kernel crash, resulting in a denial of service.

TIPC enqueue tracepoints could dump sk_receive_queue while tipc_sk_enqueue holds only the socket backlog spinlock. The backlog queue is protected in this path, but sk_receive_queue can be consumed or purged concurrently by the socket owner, so TIPC_DUMP_ALL can make tipc_skb_dump read an skb that was already dequeued or freed. This is a race condition with a use-after-free read and can lead to a KASAN report or kernel crash. For the CVSS the PR:N is used for the paranoid network-adjacent interpretation because a peer that can reach the TIPC bearer may trigger enqueue activity without local privileges on the victim when the affected tracepoints are enabled. The base local interpretation uses PR:L because a local process can more directly drive TIPC socket activity and the race timing. The issue is not a generic Internet reachable bug, but TIPC is a network protocol used in clustered or local network deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.