In the Linux kernel, the following vulnerability has been resolved:
tipc: fix a null-ptr-deref in tipc_topsrv_accept
syzbot found a crash in tipc_topsrv_accept:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] Workqueue: tipc_rcv tipc_topsrv_accept RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487 Call Trace: <TASK> tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
It was caused by srv->listener that might be set to null by tipc_topsrv_stop() in net .exit whereas it's still used in tipc_topsrv_accept() worker.
srv->listener is protected by srv->idr_lock in tipc_topsrv_stop(), so add a check for srv->listener under srv->idr_lock in tipc_topsrv_accept() to avoid the null-ptr-deref. To ensure the lsock is not released during the tipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop() where it's waiting until the tipc_topsrv_accept worker to be done.
Note that sk_callback_lock is used to protect sk->sk_user_data instead of srv->listener, and it should check srv in tipc_topsrv_listener_data_ready() instead. This also ensures that no more tipc_topsrv_accept worker will be started after tipc_conn_close() is called in tipc_topsrv_stop() where it sets sk->sk_user_data to null.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-livepatch-5.10.155-138.670Upgrade kernel-debuginfo-common-aarch64 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Oct 9, 2025 | Oct 9, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Feb 3, 2026 | Jan 30, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 7, 2025 |
| Ubuntu | — | Upgrade linux-aws-5.15Upgrade linux-gkeUpgrade linux-azureUpgrade linux-fipsUpgrade linux-bluefieldUpgrade linux-xilinx-zynqmpUpgrade linux-raspiUpgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-gcp-5.15Upgrade linux-nvidiaUpgrade linux-lowlatencyUpgrade linux-iotUpgrade linux-intel-iotg-5.15Upgrade linux-kvmUpgrade linux-oracle-5.4Upgrade linux-hwe-5.15Upgrade linux-azure-5.4Upgrade linux-raspi-5.4Upgrade linux-aws-5.4Upgrade linux-oracleUpgrade linux-intel-iotgUpgrade linux-gkeopUpgrade linux-azure-5.15Upgrade linux-gcpUpgrade linux-ibmUpgrade linuxUpgrade linux-azure-fipsUpgrade linux-oracle-5.15Upgrade linux-gcp-fipsUpgrade linux-aws-fipsUpgrade linux-gcp-5.4Upgrade linux-riscv-5.15Upgrade linux-awsUpgrade linux-hwe-5.4Upgrade linux-ibm-5.4 | Oct 10, 2025 | Oct 7, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Oct 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub