{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  tipc: fix use-after-free of the discoverer in tipc_disc_rcv()  bearer_disable() frees b-\u003edisc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b-\u003edisc in RX softirq under rcu_read_lock() (tipc_udp_recv -\u003e tipc_rcv -\u003e tipc_disc_rcv).  L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period:   BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)  Read of size 8 at addr ffff88802348b728 by task poc_tipc/184  \u003cIRQ\u003e   tipc_disc_rcv (net/tipc/discover.c:149)   tipc_rcv (net/tipc/node.c:2126)   tipc_udp_recv (net/tipc/udp_media.c:391)   udp_rcv (net/ipv4/udp.c:2643)   ip_local_deliver_finish (net/ipv4/ip_input.c:241)  \u003c/IRQ\u003e  Freed by task 181:   kfree (mm/slub.c:6565)   bearer_disable (net/tipc/bearer.c:418)   tipc_nl_bearer_disable (net/tipc/bearer.c:1001)  The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback.  Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away.  Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP.",
  "id": "DEBIAN-CVE-2026-64543",
  "modified": "2026-09-14T16:47:44.110644216Z",
  "published": "2026-07-27T21:17:06.850Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64543"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64543"
  ]
}