{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68117","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.369Z","datePublished":"2026-08-10T11:58:36.675Z","dateUpdated":"2026-08-19T16:29:29.277Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:29:29.277Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: clear sock->sk on the failed-insert path in tipc_sk_create()\n\nWhen tipc_sk_create() fails to insert the new socket (tipc_sk_insert()\nreturns non-zero), its error path frees the sk with sk_free() but leaves\nsock->sk pointing at the freed object:\n\n\tif (tipc_sk_insert(tsk)) {\n\t\tsk_free(sk);\n\t\tpr_warn(\"Socket create failed; port number exhausted\\n\");\n\t\treturn -EINVAL;\n\t}\n\nThis is harmless for plain socket(): the syscall layer clears sock->ops\nbefore releasing, so tipc_release() is never called. It is not harmless\non the accept() path. tipc_accept() creates the pre-allocated child\nsocket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves\nnew_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then\nfput()s the new file, so __sock_release() -> tipc_release() runs\nlock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the\nsk_lock spinlock.\n\ntipc_release() already guards this exact \"failed accept() releases a\npre-allocated child\" case with \"if (sk == NULL) return 0;\", but the\nguard is bypassed because tipc_sk_create() left sock->sk non-NULL\n(dangling) rather than NULL.\n\nClear sock->sk on the failed-insert path so the existing tipc_release()\nNULL check fires and the use-after-free is avoided.\n\nThe tipc_sk_insert() failure is reached when the per-netns socket\nrhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M\nelements) -- i.e. once a netns holds ~2M TIPC sockets every insert\nreturns -E2BIG.\n\n  BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)\n  Write of size 8 at addr ffff8880047cdc38 by task init/1\n   lock_sock_nested (net/core/sock.c:3839)\n   tipc_release (net/tipc/socket.c:638)\n   __sock_release (net/socket.c:710)\n   sock_close (net/socket.c:1501)\n   __fput (fs/file_table.c:512)\n  Allocated by task 1:\n   sk_alloc (net/core/sock.c:2308)\n   tipc_sk_create (net/tipc/socket.c:487)\n   tipc_accept (net/tipc/socket.c:2744)\n   do_accept (net/socket.c:2034)\n  Freed by task 1:\n   __sk_destruct (net/core/sock.c:2391)\n   tipc_sk_create (net/tipc/socket.c:504)\n   tipc_accept (net/tipc/socket.c:2744)\n   do_accept (net/socket.c:2034)"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit in tipc_accept() when a listening SOCK_STREAM/SOCK_SEQPACKET socket accepts an incoming TIPC connection; peers reach this path over default UDP/Ethernet bearers (e.g. UDP/6118) without local syscall access.\nAC:L - An attacker can deterministically fill the per-netns TIPC socket rhashtable (~2M entries) by opening many sockets or connections, then trigger the failed-insert accept() cleanup path that performs lock_sock() on the freed sk.\nPR:N - No elevated Linux capabilities are required to create AF_TIPC stream/seqpacket sockets or send unauthenticated TIPC SYN traffic to a listening cluster service; only LSM policy may restrict access.\nUI:N - Exploitation needs no end-user action beyond a server’s normal accept() loop processing inbound TIPC connection requests queued by the network stack.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security domain; impact is kernel privilege escalation or crash, not a VM/hypervisor or IOMMU boundary crossing.\nC:H - tipc_release() calls lock_sock() on a freed struct sock, a slab use-after-free that can be groomed for arbitrary kernel memory disclosure via controlled reuse of the freed socket object.\nI:H - The UAF performs an 8-byte write to sk_lock on freed memory during socket teardown, enabling heap corruption and potential arbitrary kernel write or code execution primitives.\nA:H - KASAN reports slab-use-after-free in lock_sock_nested during tipc_release on the failed accept() path, causing kernel oops/panic and denial of service even without full exploitation."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/socket.c"],"versions":[{"version":"efa78f2ae363428525fb4981bb63c555ee79f3c7","lessThan":"efebc23e9b29e3e5a9e2127dd066929f7f0d315e","status":"affected","versionType":"git"},{"version":"833ecd0eae76eadf81d6d747bb5bc992d1151867","lessThan":"8d6f26d48e61ef34f1921289401dbf36b10816af","status":"affected","versionType":"git"},{"version":"00aff3590fc0a73bddd3b743863c14e76fd35c0c","lessThan":"82f59aa27f33bd014a7d8739371ab5712d15e33b","status":"affected","versionType":"git"},{"version":"00aff3590fc0a73bddd3b743863c14e76fd35c0c","lessThan":"b07d87b31631edb6529e6cdcca790a7489d1250d","status":"affected","versionType":"git"},{"version":"00aff3590fc0a73bddd3b743863c14e76fd35c0c","lessThan":"dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea","status":"affected","versionType":"git"},{"version":"00aff3590fc0a73bddd3b743863c14e76fd35c0c","lessThan":"5f5a41a48dbf9eda57b67ce23e548602cf7195a6","status":"affected","versionType":"git"},{"version":"00aff3590fc0a73bddd3b743863c14e76fd35c0c","lessThan":"f9596b1566616a8be0592dbceccb6344a7c6f6bb","status":"affected","versionType":"git"},{"version":"00aff3590fc0a73bddd3b743863c14e76fd35c0c","lessThan":"ba0533fc163f905fe817cfabdf8ed4058da44800","status":"affected","versionType":"git"},{"version":"638fa20b618b2bbcf86da71231624cc82121a036","status":"affected","versionType":"git"},{"version":"7bc9e7f70bc57d8f02ffea2a42094281effb15ef","status":"affected","versionType":"git"},{"version":"ef488669b2652bde5b6ee5a409a5b048a2a50db4","status":"affected","versionType":"git"},{"version":"4919d82f7041157a421ca9bf39a78551d5ad8a1b","status":"affected","versionType":"git"},{"version":"3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2","status":"affected","versionType":"git"},{"version":"5.10.132","lessThan":"5.10.265","status":"affected","versionType":"semver"},{"version":"5.15.56","lessThan":"5.15.216","status":"affected","versionType":"semver"},{"version":"4.9.324","lessThan":"4.10","status":"affected","versionType":"semver"},{"version":"4.14.289","lessThan":"4.15","status":"affected","versionType":"semver"},{"version":"4.19.253","lessThan":"4.20","status":"affected","versionType":"semver"},{"version":"5.4.207","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"5.18.13","lessThan":"5.19","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/socket.c"],"versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.132","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.56","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.324"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.289"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.207"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/efebc23e9b29e3e5a9e2127dd066929f7f0d315e"},{"url":"https://git.kernel.org/stable/c/8d6f26d48e61ef34f1921289401dbf36b10816af"},{"url":"https://git.kernel.org/stable/c/82f59aa27f33bd014a7d8739371ab5712d15e33b"},{"url":"https://git.kernel.org/stable/c/b07d87b31631edb6529e6cdcca790a7489d1250d"},{"url":"https://git.kernel.org/stable/c/dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea"},{"url":"https://git.kernel.org/stable/c/5f5a41a48dbf9eda57b67ce23e548602cf7195a6"},{"url":"https://git.kernel.org/stable/c/f9596b1566616a8be0592dbceccb6344a7c6f6bb"},{"url":"https://git.kernel.org/stable/c/ba0533fc163f905fe817cfabdf8ed4058da44800"}],"title":"tipc: clear sock->sk on the failed-insert path in tipc_sk_create()","x_generator":{"engine":"bippy-1.2.0"}}}}