CVE-2026-74609

A flaw was found in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol implementation. A race condition exists in the tipc_node_link_down() function where a link pointer is cached without proper locking. This allows another process to free the link object while the cached pointer is still in use, leading to a use-after-free vulnerability. This memory corruption issue could result in a denial of service or potentially information disclosure.

TIPC has a race in tipc_node_link_down() because le link was read before taking the node lock while another path can disable a bearer and free the same tipc_link under that lock. An in flight receive path or supervision timer can then dereference freed memory in tipc_link_is_establishing() and may write to the freed object through tipc_link_reset(). For the CVSS the PR:L value is used in the paranoid score because delegated CAP_NET_ADMIN, container root, or a network management service account may be enough to disable a TIPC bearer in some deployments. The issue is not directly reachable by packets alone, but remote TIPC traffic over UDP or another bearer can help create the racing link activity when TIPC is enabled. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to UAF based memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.