From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 16EAF376A03 for ; Sat, 15 Aug 2026 06:26:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775200; cv=none; b=NX4ReCVn3vHSWhhdryMSy3/tf1TK8sKc/U4ngya7z8lGqAwCKTWN/tFJBQNr/rZ2FQPEK4Kownij2dENN3IJrebDFBqpCMx6bYQoS0eoKz6dn76SIBZjNz6yy+kql9kOPkKHH8GZNZrirPT1+nWSRAW32uSSzFcS2EhP9tk63oc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775200; c=relaxed/simple; bh=Gzjxo/n8RmknWyiapBqgRyyaLINyAPoewKK22AOnJv8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nRPckdKRdgko1Koq6fy19LJZ0zffFqpbqzHJ27/sFMD3DwFI1djC3VSsFpkkU9ljQUr7l1LCC5okOPjrydC3t0S92u3GDrDg0dWu7gDnDzZyBOuBXVcqyi8x4Qmm32b1paE3qzjiNC0KzYTZRkz52suRBFMsCDypwF1GnzNmPF4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=y47CFj3+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="y47CFj3+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E1B61F000E9; Sat, 15 Aug 2026 06:26:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775199; bh=yHvmYuwEnL3w8rIdFFSmfAT+E8I7EcQ8g+pW9/oc72Y=; h=From:To:Cc:Subject:Date:Reply-To; b=y47CFj3+O7vgxWxnFkZGIhqJ87GicHSPLiEUolEA9U+GNMCY/H2awDGs+SAKgKyn7 Py3v6GKepglaG7FMijuKvHXZOGanaQJArINC9wmLQwv+6UW6U0rwpW6CAgHmKrXG/V zKoOQhG3tlVm9elftdEQ1pS4STkBmydO5f3SdTBA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() Date: Sat, 15 Aug 2026 15:08:03 +0900 Message-ID: <2026081522-CVE-2026-72404-b809@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3916; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=HBH6dxqCw5pm4nerQeo2V7UhEyKGVdjydJG3VgZOgxA=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNDO/et8xq6xLUrHt22Xaa6tec/vnGW9Q4J270XF3mV CPhb7KoI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbCcZhhflGhFhubqPQ3vULu lrjAhd0H2r+GMSy48YzhQK5RSXt58znhxb80D+mdFmYFAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() TIPC UDP media bearer teardown calls dst_cache_destroy() on its replicast caches before calling synchronize_net() to wait for concurrent RCU readers (transmitters) to finish: static void cleanup_bearer(struct work_struct *work) { ... list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) { dst_cache_destroy(&rcast->dst_cache); list_del_rcu(&rcast->list); kfree_rcu(rcast, rcu); } ... dst_cache_destroy(&ub->rcast.dst_cache); udp_tunnel_sock_release(ub->sk); synchronize_net(); ... } This is highly buggy because dst_cache_destroy() immediately frees the per-CPU cache memory (free_percpu()) and releases the cached dst entries without any synchronization. If a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another CPU under RCU protection, it can call dst_cache_get() concurrently, leading to: 1. Use-After-Free on the per-CPU cache pointer itself (crash). 2. "rcuref - imbalanced put()" warning if it attempts to release a dst that was concurrently released by dst_cache_destroy(). Furthermore, calling kfree(ub) immediately after synchronize_net() without closing the socket first (or waiting after closing it) leaves a window where a concurrent receiver (tipc_udp_recv()) could start after synchronize_net(), access ub, and suffer a UAF when kfree(ub) runs. To fix this, we must defer dst_cache_destroy() and kfree(ub) until after we have ensured that no more readers can see the bearer/socket and all existing readers have finished: 1. Defer rcast entry destruction (both dst_cache_destroy() and kfree()) to an RCU callback using call_rcu_hurry(). Using call_rcu_hurry() ensures the dst entries are released quickly. 2. Release the bearer socket using udp_tunnel_sock_release() (stops new receive readers). 3. Call synchronize_net() to wait for all outstanding RCU readers (both transmit and receive) to finish. 4. Now that it is safe, call dst_cache_destroy() on the main bearer cache, and free ub. Note: 3) and 4) can be changed later in net-next to also use call_rcu_hurry() and get rid of the synchronize_net() latency. The Linux kernel CVE team has assigned CVE-2026-72404 to this issue. Affected and fixed versions =========================== Issue introduced in 5.3 with commit e9c1a793210f29f32ee4cf048e04d7d9bb3221cc and fixed in 7.1.5 with commit 1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c Issue introduced in 5.3 with commit e9c1a793210f29f32ee4cf048e04d7d9bb3221cc and fixed in 7.2-rc1 with commit 7116764ca53ff529335d7ab7c364a69f094b23a5 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72404 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/tipc/udp_media.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c https://git.kernel.org/stable/c/7116764ca53ff529335d7ab7c364a69f094b23a5