CVE-2026-74490

A flaw was found in the Linux kernel's TIPC (Transparent Inter-Process Communication) module. A race condition exists in the tipc_poll() function when dumping trace queue state, as it does not properly hold necessary locks. This allows a local attacker to trigger a use-after-free vulnerability by causing the system to access memory that has already been freed. This could lead to a denial of service or other unpredictable system behavior.

A moderate-severity use-after-free flaw was found in the Linux kernel's TIPC (Transparent Inter-Process Communication) module as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. TIPC socket tracepoints dump queue state through tipc_sk_dump(); most queue-dump callsites serialize that walk under the socket lock or sk->sk_lock.slock, but tipc_poll() can request a full queue dump through the tipc_sk_poll tracepoint without holding either lock. A local attacker able to interact with TIPC sockets could race this unlocked poll trace queue dump with concurrent dequeue operations on the same socket, causing the trace helper to dereference a queue entry that has already been freed, resulting in a kernel crash (denial of service) or other unpredictable behavior. No impact to confidentiality or integrity is established by the available evidence. Red Hat Enterprise Linux 6 and 7 are listed as not affected because the vulnerable code is not present in those kernel versions. Fixes for the affected Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt streams and for the Red Hat In-Vehicle OS kernel streams are deferred: this flaw is rated Moderate severity with impact limited to availability, and the vulnerable path is confined to the TIPC socket poll tracing code. The residual risk of deferral is that a local attacker could trigger a kernel panic through this race. The CVE.org record rates this flaw Important with a CVSS 3.1 score of 8.8 and a network attack vector; Red Hat assesses it as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to a system using TIPC sockets and the established consequence is loss of availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.