GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72299 (GCVE-0-2026-72299)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-23 12:47
VLAI
Title
tipc: restrict socket queue dumps in enqueue tracepoints
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tracepoints tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is owned by user context. The spinlock protects the backlog queue in this path, but it does not serialize against the socket owner consuming or purging sk_receive_queue. KASAN reported: CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123 print_report+0xce/0x5b0 mm/kasan/report.c:482 kasan_report+0xc6/0x100 mm/kasan/report.c:597 __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380 tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73 tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187 tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996 trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188 tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497 tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689 __tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512 tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400 sock_sendmsg+0x2f6/0x3e0 net/socket.c:825 splice_to_socket+0x7f9/0x1010 fs/splice.c:884 do_splice+0xe21/0x2330 fs/splice.c:936 __do_splice+0x153/0x260 fs/splice.c:1431 __x64_sys_splice+0x150/0x230 fs/splice.c:1616 x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41 do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63 entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130 RIP: 0033:0x71624e8aafe2 Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2 RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066 RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00 R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40 </TASK> The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump sk_receive_queue and can therefore dereference skbs that the socket owner has already dequeued or freed. Restrict these dumps to TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held spinlock. Keep the change limited to the enqueue path, where the unsafe queue dump is reachable while the socket is owned by user context.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0 (git)
Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < 273ff83c49b82e4267373adbe629e6ee8aeaa16c (git)
Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < 258fb15b30db4f3941ab335d5e02f744baf1da54 (git)
Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < 12876864f9de5fa6f611a30c6c17e405a773bf0a (git)
Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < b9e100815f4b55e9ccaf6af9a3aba173eb13d381 (git)
Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < 61a55fa24a5d737436018764a647fe5b6cb36371 (git)
Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < 6acbbe54215d5f4251593000cff2bf51d6748713 (git)
Affected: 01e661ebfbad40e6280fb8ec25f2861d39ba4387 , < acd7df8d955480a6f6e5bb809da67b1500cc3cf4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            },
            {
              "lessThan": "273ff83c49b82e4267373adbe629e6ee8aeaa16c",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            },
            {
              "lessThan": "258fb15b30db4f3941ab335d5e02f744baf1da54",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            },
            {
              "lessThan": "12876864f9de5fa6f611a30c6c17e405a773bf0a",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            },
            {
              "lessThan": "b9e100815f4b55e9ccaf6af9a3aba173eb13d381",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            },
            {
              "lessThan": "61a55fa24a5d737436018764a647fe5b6cb36371",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            },
            {
              "lessThan": "6acbbe54215d5f4251593000cff2bf51d6748713",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            },
            {
              "lessThan": "acd7df8d955480a6f6e5bb809da67b1500cc3cf4",
              "status": "affected",
              "version": "01e661ebfbad40e6280fb8ec25f2861d39ba4387",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: restrict socket queue dumps in enqueue tracepoints\n\ntipc_sk_enqueue() runs with sk-\u003esk_lock.slock held while the socket is\nowned by user context. The spinlock protects the backlog queue in this\npath, but it does not serialize against the socket owner consuming or\npurging sk_receive_queue.\n\nKASAN reported:\n\n  CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n    \u003cTASK\u003e\n    dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123\n    print_report+0xce/0x5b0 mm/kasan/report.c:482\n    kasan_report+0xc6/0x100 mm/kasan/report.c:597\n    __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380\n    tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73\n    tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187\n    tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996\n    trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188\n    tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497\n    tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689\n    __tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512\n    tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400\n    sock_sendmsg+0x2f6/0x3e0 net/socket.c:825\n    splice_to_socket+0x7f9/0x1010 fs/splice.c:884\n    do_splice+0xe21/0x2330 fs/splice.c:936\n    __do_splice+0x153/0x260 fs/splice.c:1431\n    __x64_sys_splice+0x150/0x230 fs/splice.c:1616\n    x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41\n    do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130\n  RIP: 0033:0x71624e8aafe2\n  Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 \u003cc3\u003e 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66\n  RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113\n  RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2\n  RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066\n  RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001\n  R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00\n  R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40\n    \u003c/TASK\u003e\n\nThe TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump\nsk_receive_queue and can therefore dereference skbs that the socket\nowner has already dequeued or freed. Restrict these dumps to\nTIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held\nspinlock.\n\nKeep the change limited to the enqueue path, where the unsafe queue dump\nis reachable while the socket is owned by user context."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - tipc_sk_enqueue() is invoked from tipc_sk_rcv() on inbound TIPC traffic (tipc_rcv()/tipc_link_rcv() from UDP/Ethernet bearers) and on loopback xmit; a remote cluster peer can deliver packets that hit the enqueue trace path while the destination socket is user-owned.\nAC:L - This is a controllable race between enqueue-time TIPC_DUMP_ALL trace dumps of sk_receive_queue and the socket owner dequeuing/freeing those skbs; the attacker drives both sides via concurrent recvmsg/splice/sendmsg threads or by flooding TIPC messages while a receiver holds lock_sock().\nPR:N - TIPC data-plane delivery to an existing socket/port needs no authentication or victim credentials; any local user may open AF_TIPC sockets (including via user namespaces with CAP_NET_ADMIN), and default sk_filter sysctl matches all sockets once trace events are enabled.\nUI:N - Exploitation needs no victim interaction beyond normal socket/cluster I/O; the attacker controls message injection and thread timing without requiring mounts, prompts, or other deliberate user actions.\nS:U - The flaw is a kernel sk_buff use-after-free in the TIPC socket path and its impact stays within the kernel security authority; it does not by itself cross VM, IOMMU, or hypervisor isolation boundaries.\nC:H - KASAN reported __asan_report_load4 in tipc_skb_dump() reading freed skb/message fields from sk_receive_queue; this UAF read of attacker-influenced heap objects can disclose kernel memory and supports further info-leak exploitation.\nI:H - Concurrent enqueue tracing walks queue pointers while skbs are freed by the socket owner, creating a classic UAF on sk_buff slabs that can be groomed for arbitrary kernel memory corruption and privilege escalation.\nA:H - Dereferencing freed skbs during tipc_list_dump()/tipc_skb_dump() can oops or panic the kernel; UAF in the TIPC receive/enqueue path is a high-availability risk even when not fully weaponized for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:12.393Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/273ff83c49b82e4267373adbe629e6ee8aeaa16c"
        },
        {
          "url": "https://git.kernel.org/stable/c/258fb15b30db4f3941ab335d5e02f744baf1da54"
        },
        {
          "url": "https://git.kernel.org/stable/c/12876864f9de5fa6f611a30c6c17e405a773bf0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9e100815f4b55e9ccaf6af9a3aba173eb13d381"
        },
        {
          "url": "https://git.kernel.org/stable/c/61a55fa24a5d737436018764a647fe5b6cb36371"
        },
        {
          "url": "https://git.kernel.org/stable/c/6acbbe54215d5f4251593000cff2bf51d6748713"
        },
        {
          "url": "https://git.kernel.org/stable/c/acd7df8d955480a6f6e5bb809da67b1500cc3cf4"
        }
      ],
      "title": "tipc: restrict socket queue dumps in enqueue tracepoints",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72299",
    "datePublished": "2026-08-15T05:55:19.147Z",
    "dateReserved": "2026-08-09T03:40:39.918Z",
    "dateUpdated": "2026-08-23T12:47:12.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72299",
      "date": "2026-09-11",
      "epss": "0.00745",
      "percentile": "0.52705"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72299\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:02.567\",\"lastModified\":\"2026-08-23T13:16:43.057\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: restrict socket queue dumps in enqueue tracepoints\\n\\ntipc_sk_enqueue() runs with sk-\u003esk_lock.slock held while the socket is\\nowned by user context. The spinlock protects the backlog queue in this\\npath, but it does not serialize against the socket owner consuming or\\npurging sk_receive_queue.\\n\\nKASAN reported:\\n\\n  CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\\n  Call Trace:\\n    \u003cTASK\u003e\\n    dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123\\n    print_report+0xce/0x5b0 mm/kasan/report.c:482\\n    kasan_report+0xc6/0x100 mm/kasan/report.c:597\\n    __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380\\n    tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73\\n    tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187\\n    tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996\\n    trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188\\n    tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497\\n    tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689\\n    __tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512\\n    tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400\\n    sock_sendmsg+0x2f6/0x3e0 net/socket.c:825\\n    splice_to_socket+0x7f9/0x1010 fs/splice.c:884\\n    do_splice+0xe21/0x2330 fs/splice.c:936\\n    __do_splice+0x153/0x260 fs/splice.c:1431\\n    __x64_sys_splice+0x150/0x230 fs/splice.c:1616\\n    x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41\\n    do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63\\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130\\n  RIP: 0033:0x71624e8aafe2\\n  Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 \u003cc3\u003e 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66\\n  RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113\\n  RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2\\n  RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066\\n  RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001\\n  R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00\\n  R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40\\n    \u003c/TASK\u003e\\n\\nThe TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump\\nsk_receive_queue and can therefore dereference skbs that the socket\\nowner has already dequeued or freed. Restrict these dumps to\\nTIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held\\nspinlock.\\n\\nKeep the change limited to the enqueue path, where the unsafe queue dump\\nis reachable while the socket is owned by user context.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/socket.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"273ff83c49b82e4267373adbe629e6ee8aeaa16c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"258fb15b30db4f3941ab335d5e02f744baf1da54\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"12876864f9de5fa6f611a30c6c17e405a773bf0a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"b9e100815f4b55e9ccaf6af9a3aba173eb13d381\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"61a55fa24a5d737436018764a647fe5b6cb36371\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"6acbbe54215d5f4251593000cff2bf51d6748713\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01e661ebfbad40e6280fb8ec25f2861d39ba4387\",\"lessThan\":\"acd7df8d955480a6f6e5bb809da67b1500cc3cf4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/socket.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.266\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12876864f9de5fa6f611a30c6c17e405a773bf0a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/258fb15b30db4f3941ab335d5e02f744baf1da54\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/273ff83c49b82e4267373adbe629e6ee8aeaa16c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/61a55fa24a5d737436018764a647fe5b6cb36371\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6acbbe54215d5f4251593000cff2bf51d6748713\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acd7df8d955480a6f6e5bb809da67b1500cc3cf4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b9e100815f4b55e9ccaf6af9a3aba173eb13d381\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T20:57:25+00:00",
      "cve": "CVE-2026-72299",
      "id": "CVE-2026-72299",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: restrict socket queue dumps in enqueue tracepoints",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72299.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.