Linux Kernel TIPC: Race condition during topology server shutdown
Summary
A race condition in the TIPC topology server shutdown path of the Linux kernel can lead to use-after-free, refcount errors, queueing work on destroyed workqueues and RCU stalls. A local user with low privileges can trigger it, which may cause a kernel crash or denial of service and possibly memory corruption. TIPC is mainly used in clustered or telecom-style setups and is rarely needed on ordinary SME systems.
Affected
- Linux kernel from 3.11 up to the fixed stable releases listed below
- Affected commits start at c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f
Fixed in
- 5.10.273 (5.10 branch)
- 5.15.224 (5.15 branch)
- 6.1.191 (6.1 branch)
- 6.6.160 (6.6 branch)
- 6.12.113 (6.12 branch)
- 6.18.57 (6.18 branch)
- 7.2.11 (7.2 branch)
- Use the package version from your distribution's advisory, as distributions may backport the fix differently
Workaround
- No vendor workaround known.
- If TIPC is not needed, prevent the tipc module from loading (check first with lsmod | grep tipc).
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- EPSS: 0.00159 (very low).
Our recommendation
- Install the kernel update from your distribution as part of the normal update cycle, with higher priority on multi-user or shared hosts.
- Check whether TIPC is used on your systems and disable it if it is not needed.
- Restrict local shell access to trusted users.
- Verify the running kernel version after the reboot.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 09dbd610f78aaed65d7b379c270ce4090a8151ac git.kernel.org
- Linux stable commit 3acdd44385bc7e2e57605e073691ce69cc5a960d git.kernel.org
- Linux stable commit 7f796bb3b440d7f1b14c0e3b520462eb34f553af git.kernel.org
- Ubuntu security notice CVE-2026-99054 ubuntu.com
- Red Hat CVE data CVE-2026-99054 access.redhat.com
- NVD record CVE-2026-99054 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:22.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more work, and in-flight send/recv work could drop the last connection reference during the conn_idr walk. That race produced several teardown failures: refcount_t addition on 0 from conn_get() on a connection whose release was blocked on idr_lock, a subsequent use-after-free in tipc_conn_close(), queue_work() on an already destroyed workqueue from the listener data-ready callback, and an RCU stall in tipc_topsrv_exit_net() while the walk spun under idr_lock. Clear srv->listener under idr_lock so it acts as a shutdown flag, skip queue_work() once it is NULL, destroy the workqueues to flush in-flight work, and only then close the remaining connections. Refuse tipc_conn_lookup() after that flag is cleared, and drop idr_lock when the teardown walk finds no connection, so an in-flight subscription event cannot pin idr_in_use while the walk holds the lock. v3 supersedes the narrower in-thread diff Tung Quang Nguyen posted on 2026-09-23. It keeps his teardown order and adds the lookup refusal and the empty-idr unlock.
NVD references (8)
- https://git.kernel.org/stable/c/09dbd610f78aaed65d7b379c270ce4090a8151ac
- https://git.kernel.org/stable/c/0af8780bdfdfc91fb9127bddb9c48fab67dc9d9e
- https://git.kernel.org/stable/c/21622e5ae8b232c2e64eb1adf5546cf078d2987d
- https://git.kernel.org/stable/c/3acdd44385bc7e2e57605e073691ce69cc5a960d
- https://git.kernel.org/stable/c/7167afaaaee37191f8b6afa0c91e0fef41460705
- https://git.kernel.org/stable/c/7f796bb3b440d7f1b14c0e3b520462eb34f553af
- https://git.kernel.org/stable/c/da9c16568bc79140a54c1f5fcf07a0305df47b37
- https://git.kernel.org/stable/c/fb717c536af2aafeca520ff11d1e0f25f7ab8fa9
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.