CVE-2026-99246

A flaw was found in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. A race condition occurs when tracing link reset events without proper locking, which can cause link data to be freed while it is actively being accessed. An unauthenticated remote attacker could exploit this use-after-free vulnerability by sending network traffic that triggers link resets during connection teardown. Successful exploitation could lead to arbitrary code execution or a Denial of Service (DoS) through a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to acquire the TIPC node write lock across trace_tipc_node_reset_links or disable TIPC node reset tracepoints to prevent unlocked link dumping: upgrade to the corresponding fixed Red Hat builds, which acquire the node write lock around trace_tipc_node_reset_links to serialize trace dumping against link deletion, closing crafted TIPC network traffic triggering link resets during concurrent bearer teardown. Until patched, this is only a concern on Linux systems with the TIPC module and bearer enabled and node reset tracepoints actively monitored — Linux systems without the TIPC module loaded or active bearers are unaffected — so disable active TIPC node reset tracepoints, restrict network access to TIPC bearer interfaces, and avoid concurrent bearer teardown operations. As a compensating measure, enable KASAN or HWASan to detect kernel slab use-after-free reads when stale link pointers are accessed, enforce NX/XD non-executable memory permissions on kernel heap and data pages to prevent shellcode execution, enable KASLR to randomize kernel base addresses and impede code execution following stale pointer dereferencing, enable SMEP to block the kernel from executing userspace memory pages during exploit payload delivery, enable SMAP to block supervisor access to userspace memory structures during privilege escalation attempts, and enforce Control Flow Integrity and Shadow Call Stack to prevent forward-edge indirect branch redirection in kernel space. These controls limit blast radius and contain exploitation, but they do not fix the underlying race condition use-after-free defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)