Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99054— tipc: destroy topsrv workqueues before closing connections

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： tipc：在关闭连接之前销毁 topsrv 工作队列在拓扑服务器（topology server）的发送和接收工作队列仍在运行时关闭了订阅者连接。此时，套接字回调和订阅事件仍可能继续排队新任务，而正在进行的发送/接收任务可能在遍历时释放了最后一个连接引用。这种竞态条件导致了多种清理失败：在中对引用计数为 0 的连接执行了加法操作（该连接的释放被阻塞）；随后在中发生了释放后使用（use-after-free）；监听器的数据就绪回调在已销毁的工作队列上执

CVSS 7.8 · High EPSS 0.21% · P10 Updated Oct 24, 2026

Possible ATT&CK Techniques 3 AI

T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

Vendor	Product	Version Range	Status
Linux	Linux	`c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f< 7f796bb3b440d7f1b14c0e3b520462eb34f553af`	affected
		`c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f< da9c16568bc79140a54c1f5fcf07a0305df47b37`	affected
		`c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f< 0af8780bdfdfc91fb9127bddb9c48fab67dc9d9e`	affected
		`c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f< fb717c536af2aafeca520ff11d1e0f25f7ab8fa9`	affected
		`c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f< 3acdd44385bc7e2e57605e073691ce69cc5a960d`	affected
		`3.11`	affected
		`< 3.11`	unaffected
		`6.6.160≤ 6.6.*`	unaffected
… +4 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

tipc: destroy topsrv workqueues before closing connections

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more work, and in-flight send/recv work could drop the last connection reference during the conn_idr walk. That race produced several teardown failures: refcount_t addition on 0 from conn_get() on a connection whose release was blocked on idr_lock, a subsequent use-after-free in tipc_conn_close(), queue_work() on an already destroyed workqueue from the listener data-ready callback, and an RCU stall in tipc_topsrv_exit_net() while the walk spun under idr_lock. Clear srv->listener under idr_lock so it acts as a shutdown flag, skip queue_work() once it is NULL, destroy the workqueues to flush in-flight work, and only then close the remaining connections. Refuse tipc_conn_lookup() after that flag is cleared, and drop idr_lock when the teardown walk finds no connection, so an in-flight subscription event cannot pin idr_in_use while the walk holds the lock. v3 supersedes the narrower in-thread diff Tung Quang Nguyen posted on 2026-09-23. It keeps his teardown order and adds the lookup refusal and the empty-idr unlock.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f ~ 7f796bb3b440d7f1b14c0e3b520462eb34f553af	-
Linux	Linux	3.11	-

II. Public POCs for CVE-2026-99054

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99054

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99054 (5)

https://www.cve.org/CVERecord?id=CVE-2026-99054

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-98870	8.8 HIGH	ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99042	8.4 HIGH	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-98975	7.8 HIGH	xfs: stop exchanging reflink flags when exchanging mappings
CVE-2026-98889	7.8 HIGH	wifi: iwlwifi: mvm: fix sched scan IE sizing
CVE-2026-99050	7.8 HIGH	gpio: mpsse: fix race when arming the IRQ poll worker
CVE-2026-98974	7.8 HIGH	xfs: fix exchange-range-to-eof file size exchange
CVE-2026-98999	7.8 HIGH	drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99056	7.8 HIGH	strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-98976	7.8 HIGH	namespace: keep the lock on a mount that a propagated copy is moved beneath

Showing top 20 of 218 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux