CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
but tipc_disc_rcv() still dereferences b->disc in RX softirq under
rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).

L2 bearers are safe thanks to the synchronize_net() in
tipc_disable_l2_media(), but the UDP bearer defers that call to the
cleanup_bearer() workqueue, so the discoverer is freed with no grace
period:

 BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)
 Read of size 8 at addr ffff88802348b728 by task poc_tipc/184
 <IRQ>
  tipc_disc_rcv (net/tipc/discover.c:149)
  tipc_rcv (net/tipc/node.c:2126)
  tipc_udp_recv (net/tipc/udp_media.c:391)
  udp_rcv (net/ipv4/udp.c:2643)
  ip_local_deliver_finish (net/ipv4/ip_input.c:241)
 </IRQ>
 Freed by task 181:
  kfree (mm/slub.c:6565)
  bearer_disable (net/tipc/bearer.c:418)
  tipc_nl_bearer_disable (net/tipc/bearer.c:1001)

The bearer is freed with kfree_rcu(); free the discoverer the same way.
Add an rcu_head to struct tipc_discoverer and free it and its skb from an
RCU callback.

Because the RCU callback (tipc_disc_free_rcu) lives in module text, a
call_rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu_barrier() to tipc_exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.

Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC
and CONFIG_TIPC_MEDIA_UDP.

The Linux kernel CVE team has assigned CVE-2026-64543 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.17 with commit 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 and fixed in 6.6.145 with commit 5e215bf1c47fdddf8203a0fe80a0ed594065f101
	Issue introduced in 4.17 with commit 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 and fixed in 6.12.97 with commit ec7d54d8cc1723921d671e3272b427c96366506f
	Issue introduced in 4.17 with commit 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 and fixed in 6.18.40 with commit a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2
	Issue introduced in 4.17 with commit 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 and fixed in 7.1.5 with commit b65289e1c3f352a9f92c6e19713ddd647e033253
	Issue introduced in 4.17 with commit 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 and fixed in 7.2-rc1 with commit 1579342d71133da7f00daa02c75cebec7372097b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64543
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/tipc/core.c
	net/tipc/discover.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101
	https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f
	https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2
	https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253
	https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b