CVE-2026-63801

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the per-netns tipc_crypto, and the completio...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 171d31245d11bf84836fad3b394cb465a4d008ec, >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 2d1f21419ec121232c916d3a3fc9b6766473a0e7, >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 0a780653b2a7569a7af9be7d0b00b1251baca63a, >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < eaca7dae02fab70c8d223cffe03cec1b93249ce2, >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < dca7713fe044a2067387948557ea099056e1679e, >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < e18769616fd5a90ec1e12aabbba544c488284292, >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 1eea5e1820a2f5164d706bd1277bc97ff31ce32d, >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < bda3348872a2ef0d19f2df6aa8cb5025adce2f20, >= 5.5, >= 5.5 < 5.10.260, >= 5.11 < 5.15.211, >= 5.16 < 6.1.177, >= 6.2 < 6.6.144, >= 6.7 < 6.12.95, >= 6.13 < 6.18.38, >= 6.19 < 7.1.3

Fixed versions

5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416