CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()
returns non-zero), its error path frees the sk with sk_free() but leaves
sock->sk pointing at the freed object:

	if (tipc_sk_insert(tsk)) {
		sk_free(sk);
		pr_warn("Socket create failed; port number exhausted\n");
		return -EINVAL;
	}

This is harmless for plain socket(): the syscall layer clears sock->ops
before releasing, so tipc_release() is never called. It is not harmless
on the accept() path. tipc_accept() creates the pre-allocated child
socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves
new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then
fput()s the new file, so __sock_release() -> tipc_release() runs
lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the
sk_lock spinlock.

tipc_release() already guards this exact "failed accept() releases a
pre-allocated child" case with "if (sk == NULL) return 0;", but the
guard is bypassed because tipc_sk_create() left sock->sk non-NULL
(dangling) rather than NULL.

Clear sock->sk on the failed-insert path so the existing tipc_release()
NULL check fires and the use-after-free is avoided.

The tipc_sk_insert() failure is reached when the per-netns socket
rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M
elements) -- i.e. once a netns holds ~2M TIPC sockets every insert
returns -E2BIG.

  BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
  Write of size 8 at addr ffff8880047cdc38 by task init/1
   lock_sock_nested (net/core/sock.c:3839)
   tipc_release (net/tipc/socket.c:638)
   __sock_release (net/socket.c:710)
   sock_close (net/socket.c:1501)
   __fput (fs/file_table.c:512)
  Allocated by task 1:
   sk_alloc (net/core/sock.c:2308)
   tipc_sk_create (net/tipc/socket.c:487)
   tipc_accept (net/tipc/socket.c:2744)
   do_accept (net/socket.c:2034)
  Freed by task 1:
   __sk_destruct (net/core/sock.c:2391)
   tipc_sk_create (net/tipc/socket.c:504)
   tipc_accept (net/tipc/socket.c:2744)
   do_accept (net/socket.c:2034)

The Linux kernel CVE team has assigned CVE-2026-68117 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 6.6.148 with commit b07d87b31631edb6529e6cdcca790a7489d1250d
	Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 6.12.101 with commit dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea
	Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 6.18.42 with commit 5f5a41a48dbf9eda57b67ce23e548602cf7195a6
	Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 7.1.6 with commit f9596b1566616a8be0592dbceccb6344a7c6f6bb
	Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 7.2-rc5 with commit ba0533fc163f905fe817cfabdf8ed4058da44800
	Issue introduced in 4.9.324 with commit 638fa20b618b2bbcf86da71231624cc82121a036
	Issue introduced in 4.14.289 with commit 7bc9e7f70bc57d8f02ffea2a42094281effb15ef
	Issue introduced in 4.19.253 with commit ef488669b2652bde5b6ee5a409a5b048a2a50db4
	Issue introduced in 5.4.207 with commit 4919d82f7041157a421ca9bf39a78551d5ad8a1b
	Issue introduced in 5.10.132 with commit efa78f2ae363428525fb4981bb63c555ee79f3c7
	Issue introduced in 5.15.56 with commit 833ecd0eae76eadf81d6d747bb5bc992d1151867
	Issue introduced in 5.18.13 with commit 3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68117
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/tipc/socket.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b07d87b31631edb6529e6cdcca790a7489d1250d
	https://git.kernel.org/stable/c/dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea
	https://git.kernel.org/stable/c/5f5a41a48dbf9eda57b67ce23e548602cf7195a6
	https://git.kernel.org/stable/c/f9596b1566616a8be0592dbceccb6344a7c6f6bb
	https://git.kernel.org/stable/c/ba0533fc163f905fe817cfabdf8ed4058da44800