CVE-2026-63801

취약점 유형

In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the per-netns tipc_crypto, and the completion then reads it: tipc_aead_decrypt_done() dereferences aead->crypto->stats and aead->crypto->net, and tipc_crypto_rcv_complete() dereferences aead->crypto->aead[] and the node table -- reading freed memory. Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO): BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999) Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51 Workqueue: events_unbound Call Trace: tipc_aead_decrypt_done (net/tipc/crypto.c:999) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/w

영향받는 제품

• linux linux_kernel

참고 자료

• https://git.kernel.org/stable/c/0a780653b2a7569a7af9be7d0b00b1251baca63a
• https://git.kernel.org/stable/c/171d31245d11bf84836fad3b394cb465a4d008ec
• https://git.kernel.org/stable/c/1eea5e1820a2f5164d706bd1277bc97ff31ce32d
• https://git.kernel.org/stable/c/2d1f21419ec121232c916d3a3fc9b6766473a0e7
• https://git.kernel.org/stable/c/bda3348872a2ef0d19f2df6aa8cb5025adce2f20
• https://git.kernel.org/stable/c/dca7713fe044a2067387948557ea099056e1679e