{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.115-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  tipc: protect node reset trace dump with node lock  The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock.  This permits bearer teardown to free a link while the trace callback is dumping it:    CPU 0                                CPU 1   trace_tipc_node_reset_links()     tipc_node_dump()       l = n-\u003elinks[0].link                                        tipc_node_write_lock()                                        kfree(l)                                        n-\u003elinks[0].link = NULL                                        tipc_node_write_unlock()       tipc_link_dump(l)  tipc_link_dump() then dereferences the stale pointer. KASAN reported:    BUG: KASAN: slab-use-after-free in tipc_link_dump   Read of size 4 by task poc/115   Call Trace:    tipc_link_dump+0x10cb/0x16b0    tipc_node_dump+0x4bb/0x740    trace_event_raw_event_tipc_node_class+0x258/0x360    tipc_node_reset_links+0x14d/0x1a0    tipc_rcv+0x13f5/0x3030    tipc_udp_recv+0x4e3/0x670   Allocated by task 0:    tipc_link_create+0x1e1/0x1020    tipc_node_check_dest+0x7d2/0x11a0    tipc_disc_rcv+0xdbf/0x1430   Freed by task 89:    kfree+0x131/0x3c0    tipc_node_link_down+0x267/0x4b0    tipc_node_delete_links+0xec/0x160    bearer_disable+0x107/0x260  Take the node write lock around the trace event. This serializes the dump against tipc_node_link_down(delete=true), which frees the link under the same write lock.",
  "id": "DEBIAN-CVE-2026-99246",
  "modified": "2026-11-04T04:47:31.445439755Z",
  "published": "2026-11-03T12:17:31.030Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99246"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-99246"
  ]
}