CVE-2026-63801
published 2026-07-19CVE-2026-63801: In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes…
PriorityP349high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.49%
39.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to
crypto_aead_decrypt(req) without taking a reference on the netns, unlike
the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously
(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs
tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the
meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the
per-netns tipc_crypto, and the completion then reads it:
tipc_aead_decrypt_done() dereferences aead->crypto->stats and
aead->crypto->net, and tipc_crypto_rcv_complete() dereferences
aead->crypto->aead[] and the node table -- reading freed memory.
Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):
BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)
Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51
Workqueue: events_unbound
Call Trace:
tipc_aead_decrypt_done (net/tipc/crypto.c:999)
process_one_work (kernel/workqueue.c:3314)
worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 169:
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
tipc_crypto_start (net/tipc/crypto.c:1502)
tipc_init_net (net/tipc/core.c:72)
ops_init (net/core/net_namespace.c:137)
setup_net (net/core/net_namespace.c:446)
copy_net_ns (net/core/net_namespace.c:579)
create_new_namespaces (kernel/nsproxy.c:132)
__x64_sys_unshare (kernel/fork.c:3316)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Freed by task 8:
kfree (mm/slub.c:6566)
tipc_exit_net (net/tipc/core.c:119)
cleanup_net (net/core/net_namespace.c:704)
process_one_work (kernel/workqueue.c:3314)
kthread
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 171d31245d11bf84836fad3b394cb465a4d008ec | 171d31245d11bf84836fad3b394cb465a4d008ec |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 2d1f21419ec121232c916d3a3fc9b6766473a0e7 | 2d1f21419ec121232c916d3a3fc9b6766473a0e7 |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 0a780653b2a7569a7af9be7d0b00b1251baca63a | 0a780653b2a7569a7af9be7d0b00b1251baca63a |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < eaca7dae02fab70c8d223cffe03cec1b93249ce2 | eaca7dae02fab70c8d223cffe03cec1b93249ce2 |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < dca7713fe044a2067387948557ea099056e1679e | dca7713fe044a2067387948557ea099056e1679e |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < e18769616fd5a90ec1e12aabbba544c488284292 | e18769616fd5a90ec1e12aabbba544c488284292 |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < 1eea5e1820a2f5164d706bd1277bc97ff31ce32d | 1eea5e1820a2f5164d706bd1277bc97ff31ce32d |
| linux | linux | >= fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 < bda3348872a2ef0d19f2df6aa8cb5025adce2f20 | bda3348872a2ef0d19f2df6aa8cb5025adce2f20 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.11 < 5.15.211 | 5.15.211 |
| linux | linux_kernel | >= 5.16 < 6.1.177 | 6.1.177 |
| linux | linux_kernel | >= 5.5 < 5.10.260 | 5.10.260 |
| linux | linux_kernel | >= 6.13 < 6.18.38 | 6.18.38 |
| linux | linux_kernel | >= 6.19 < 7.1.3 | 7.1.3 |
| linux | linux_kernel | >= 6.2 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_
ghsa_unreviewed·2026-07-19
CVE-2026-63801 [HIGH] In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to
crypto_aead_decrypt(req) without taking a reference on the netns, unlike
the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously
(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs
tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the
meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the
per-netns tipc_crypto, and the completion then reads it:
tipc_aead_decrypt_done() dereferences aead->crypto->stats and
aead->crypto->net, and tipc_crypto_rcv_complete() dereferences
aead->crypto->aead[] and the node table -- reading freed me
Red Hat
kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
vendor_redhat·2026-07-19·CVSS 8.8
CVE-2026-63801 [HIGH] CWE-825 kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to
crypto_aead_decrypt(req) without taking a reference on the netns, unlike
the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously
(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs
tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the
meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the
per-netns tipc_crypto, and the completion then reads it:
tipc_aead_decrypt_done() dereferences aead->crypto->stats and
aead->crypto->net, and tipc_crypto_rcv_complete() dere
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0a780653b2a7569a7af9be7d0b00b1251baca63ahttps://git.kernel.org/stable/c/171d31245d11bf84836fad3b394cb465a4d008echttps://git.kernel.org/stable/c/1eea5e1820a2f5164d706bd1277bc97ff31ce32dhttps://git.kernel.org/stable/c/2d1f21419ec121232c916d3a3fc9b6766473a0e7https://git.kernel.org/stable/c/bda3348872a2ef0d19f2df6aa8cb5025adce2f20https://git.kernel.org/stable/c/dca7713fe044a2067387948557ea099056e1679ehttps://git.kernel.org/stable/c/e18769616fd5a90ec1e12aabbba544c488284292https://git.kernel.org/stable/c/eaca7dae02fab70c8d223cffe03cec1b93249ce2
2026-07-19
Published