From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8A4933C6606 for ; Mon, 10 Aug 2026 12:01:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363319; cv=none; b=Mo0HmiT2BZSddfdgHM0J+gvcnyoV6NItjUKGvFQZ0wWJJ+K4j4GNHSGS2UOJB5HX0pui3zfqqDObwL38b003OUweeC7sbh0tGPd+yc9hvev7rUNMOKRTZs1iHwi5DjmWi9zebjiVb+NJuV6jp7aBfwa2K8vk4WuI5ZXbJZ1Xvmw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363319; c=relaxed/simple; bh=RfsjD/KJ4RbhKq4/wAFVLM8rSbQT5UcVZvNTj240tBI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=IqjQNb6gNzSASkiG+SB6o3cLzG3EJalV5XQ10R+ZTTjlaDWg/PwEHxqOnDJ+7rr55jsgaEGnYZ1teUIJyTZHwKiR8RH99fNPMBUBaIPRcEusQS0T8SUVyumobWLEHdRcFKvm6Y+ByJsYE5WJN4O3JUSdm5IBcX65o+neh0JPBNc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Gowg9yFK; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Gowg9yFK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A85E1F000E9; Mon, 10 Aug 2026 12:01:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786363318; bh=rEviRJFYKgY664vF0ZlnWLXhrEXIuLEjQriQ+gYmheE=; h=From:To:Cc:Subject:Date:Reply-To; b=Gowg9yFKuom7n8S5Bljr6GzuymX2yr0HQ9S+R9up6j4OyWs2tsvJ4PFNlZwKxUVZc eF0frBVag2q+NhugbVEXTnjWrpuwsdDnPX/TN6UNv0/I76WVh2Uldd7lYLAdnkAdxU 2qA9vUVQHxQLIrYV2tnOkHuy9RV0LjSMFO2evuSk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Date: Mon, 10 Aug 2026 13:57:14 +0200 Message-ID: <2026081055-CVE-2026-68117-dd27@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5155; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Zt7SH4rC96ztY2yywkDzgdPh3S8vGmrlfwU64WGs1MA=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmVe9rn18fnpTw/YD+5NflG+dsG7fx6/elLvrywEeJiP HRo6Q77jlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAbjIC4YFN+7aLBBeJqMQd5Gr dcLhP7XzFjNlMSzY86RYkdNn+jbr/Qo8L+1+xa7ce/0fAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() When tipc_sk_create() fails to insert the new socket (tipc_sk_insert() returns non-zero), its error path frees the sk with sk_free() but leaves sock->sk pointing at the freed object: if (tipc_sk_insert(tsk)) { sk_free(sk); pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } This is harmless for plain socket(): the syscall layer clears sock->ops before releasing, so tipc_release() is never called. It is not harmless on the accept() path. tipc_accept() creates the pre-allocated child socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then fput()s the new file, so __sock_release() -> tipc_release() runs lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the sk_lock spinlock. tipc_release() already guards this exact "failed accept() releases a pre-allocated child" case with "if (sk == NULL) return 0;", but the guard is bypassed because tipc_sk_create() left sock->sk non-NULL (dangling) rather than NULL. Clear sock->sk on the failed-insert path so the existing tipc_release() NULL check fires and the use-after-free is avoided. The tipc_sk_insert() failure is reached when the per-netns socket rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M elements) -- i.e. once a netns holds ~2M TIPC sockets every insert returns -E2BIG. BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839) Write of size 8 at addr ffff8880047cdc38 by task init/1 lock_sock_nested (net/core/sock.c:3839) tipc_release (net/tipc/socket.c:638) __sock_release (net/socket.c:710) sock_close (net/socket.c:1501) __fput (fs/file_table.c:512) Allocated by task 1: sk_alloc (net/core/sock.c:2308) tipc_sk_create (net/tipc/socket.c:487) tipc_accept (net/tipc/socket.c:2744) do_accept (net/socket.c:2034) Freed by task 1: __sk_destruct (net/core/sock.c:2391) tipc_sk_create (net/tipc/socket.c:504) tipc_accept (net/tipc/socket.c:2744) do_accept (net/socket.c:2034) The Linux kernel CVE team has assigned CVE-2026-68117 to this issue. Affected and fixed versions =========================== Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 6.6.148 with commit b07d87b31631edb6529e6cdcca790a7489d1250d Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 6.12.101 with commit dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 6.18.42 with commit 5f5a41a48dbf9eda57b67ce23e548602cf7195a6 Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 7.1.6 with commit f9596b1566616a8be0592dbceccb6344a7c6f6bb Issue introduced in 5.19 with commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c and fixed in 7.2-rc5 with commit ba0533fc163f905fe817cfabdf8ed4058da44800 Issue introduced in 4.9.324 with commit 638fa20b618b2bbcf86da71231624cc82121a036 Issue introduced in 4.14.289 with commit 7bc9e7f70bc57d8f02ffea2a42094281effb15ef Issue introduced in 4.19.253 with commit ef488669b2652bde5b6ee5a409a5b048a2a50db4 Issue introduced in 5.4.207 with commit 4919d82f7041157a421ca9bf39a78551d5ad8a1b Issue introduced in 5.10.132 with commit efa78f2ae363428525fb4981bb63c555ee79f3c7 Issue introduced in 5.15.56 with commit 833ecd0eae76eadf81d6d747bb5bc992d1151867 Issue introduced in 5.18.13 with commit 3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-68117 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/tipc/socket.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b07d87b31631edb6529e6cdcca790a7489d1250d https://git.kernel.org/stable/c/dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea https://git.kernel.org/stable/c/5f5a41a48dbf9eda57b67ce23e548602cf7195a6 https://git.kernel.org/stable/c/f9596b1566616a8be0592dbceccb6344a7c6f6bb https://git.kernel.org/stable/c/ba0533fc163f905fe817cfabdf8ed4058da44800