CVE-2026-72404 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()

🗓️ 15 Aug 2026 05:56:28Reported by GoogleType

osv_cve🔗 osv.dev👁 39 Views

TIPC cleanup_bearer() prematurely destroys dst_cache and frees bearer under RCU, causing use-after-free and imbalanced put warnings.

Reporter	Title	Published	Views	Family All 23
CVE	CVE-2026-72404	15 Aug 202605:56	–	cve
Cvelist	CVE-2026-72404 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()	15 Aug 202605:56	–	cvelist
Debian CVE	CVE-2026-72404	15 Aug 202605:56	–	debiancve
EUVD	EUVD-2026-59303	15 Aug 202605:56	–	euvd
Microsoft CVE	tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()	23 Aug 202621:57	–	mscve
NVD	CVE-2026-72404	15 Aug 202606:22	–	nvd
osv_azl	AZL-96387 CVE-2026-72404 affecting package kernel 6.6.157.1-1	15 Aug 202606:22	–	osv_azl
osv_bell	BELL-CVE-2026-72404	18 Aug 202606:06	–	osv_bell
osv_debian	DEBIAN-CVE-2026-72404	15 Aug 202606:22	–	osv_debian
osv_oesa	OESA-2026-3707 kernel security update	14 Sep 202616:33	–	osv_oesa

Source	Link
git	www.git.kernel.org/stable/c/1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c
git	www.git.kernel.org/stable/c/3827ff67f9fbecd1086e33d23693ef6a1a9c6c38
git	www.git.kernel.org/stable/c/7116764ca53ff529335d7ab7c364a69f094b23a5
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72404.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-72404
git	www.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

16 Oct 2026 02:48Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.17.8

EPSS0.00168