{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  tipc: read le-\u003elink under the node lock in tipc_node_link_down()  tipc_node_link_down() caches the link pointer before taking n-\u003elock:  \tstruct tipc_link *l = le-\u003elink;\t\t/* unlocked */  \tif (!l) \t\treturn; \ttipc_node_write_lock(n); \tif (!tipc_link_is_establishing(l)) {\t/* deref l */ \t... \t\ttipc_link_reset(l);\t\t/* write into l */ \tif (delete) { \t\tkfree(l); \t\tle-\u003elink = NULL;  The delete=true caller frees that very object under n-\u003elock, so the lock does not protect the cached pointer against it:   - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link    supervision timer via tipc_node_timeout(), reads l unlocked and then    dereferences it under n-\u003elock;  - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -\u003e bearer_disable()    -\u003e tipc_node_delete_links() -\u003e tipc_node_link_down(n, bearer_id, true)    -\u003e kfree(l).  The link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers disable_media() only schedules the asynchronous cleanup_bearer() work, so its synchronize_net() runs after the links are already gone.  An in-flight CPU A that has read l therefore dereferences freed memory once B frees it: a use-after-free read in tipc_link_is_establishing(), and a use-after-free write via tipc_link_reset() on the establishing branch.  The following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:    BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)   Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0    tipc_link_is_establishing (net/tipc/link.c:285)    tipc_node_link_down (net/tipc/node.c:1076)    tipc_node_timeout (net/tipc/node.c:843)   Allocated by task 9549:    tipc_link_create (net/tipc/link.c:490)    tipc_node_check_dest (net/tipc/node.c:1279)    tipc_disc_rcv (net/tipc/discover.c:252)    tipc_udp_recv (net/tipc/udp_media.c:389)   Freed by task 9549:    tipc_node_link_down (net/tipc/node.c:1084)    tipc_node_delete_links (net/tipc/node.c:1320)    bearer_disable (net/tipc/bearer.c:414)    __tipc_nl_bearer_disable (net/tipc/bearer.c:992)  Move the le-\u003elink read inside tipc_node_write_lock(), so it is serialised against the kfree() in the delete path.  A racing teardown now either has not run yet, and we see a valid link, or has already run, and we see NULL.",
  "id": "DEBIAN-CVE-2026-74609",
  "modified": "2026-09-19T21:47:27.465642201Z",
  "published": "2026-08-22T16:16:33.407Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74609"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-74609"
  ]
}