# CVE-2026-99246: tipc: protect node reset trace dump with node lock

CVE-2026-99246 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99246, released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-99246
- Priority: High
- CVSS: 8.1 (Important)
- EPSS: 0.0044
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 3, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99246

## Description

In the Linux kernel, the following vulnerability has been resolved:  tipc: protect node reset trace dump with node lock  The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock.  This permits bearer teardown to free a link while the trace callback is dumping it:    CPU 0                                CPU 1   trace_tipc_node_reset_links()     tipc_node_dump()       l = n->links[0].link                                        tipc_node_write_lock()                                        kfree(l)                                        n->links[0].link = NULL                                        tipc_node_write_unlock()       tipc_link_dump(l)  tipc_link_dump() then dereferences the stale pointer. KASAN reported:    BUG: KASAN: slab-use-after-free in tipc_link_dump   Read of size 4 by task poc/115   Call Trace:    tipc_link_dump+0x10cb/0x16b0    tipc_node_dump+0x4bb/0x740    trace_event_raw_event_tipc_node_class+0x258/0x360    tipc_node_reset_links+0x14d/0x1a0    tipc_rcv+0x13f5/0x3030    tipc_udp_recv+0x4e3/0x670   Allocated by task 0:    tipc_link_create+0x1e1/0x1020    tipc_node_check_dest+0x7d2/0x11a0    tipc_disc_rcv+0xdbf/0x1430   Freed by task 89:    kfree+0x131/0x3c0    tipc_node_link_down+0x267/0x4b0    tipc_node_delete_links+0xec/0x160    bearer_disable+0x107/0x260  Take the node write lock around the trace event. This serializes the dump against tipc_node_link_down(delete=true), which frees the link under the same write lock.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-1 | [DEBIAN-CVE-2026-99246](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99246.md) | Nov 3, 2026 |
| Linux | linux Debian 14 | 7.2.13-1 | [DEBIAN-CVE-2026-99246](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99246.md) | Nov 3, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.