In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop()… (CVE-2026-99054)

The Linux kernel vulnerability CVE-2026-99054 affects the TIPC subsystem's topology server. The function tipc_topsrv_stop() closed subscriber connections while send and receive workqueues were still active, allowing socket callbacks and subscription events to queue additional work. This race condition caused multiple teardown failures including refcount additions on zero, use-after-free in tipc_conn_close(), queue_work() calls on destroyed workqueues, and RCU stalls during tipc_topsrv_exit_net(). The patch introduces a shutdown flag by clearing srv->listener under idr_lock, skips queue_work() if the flag is set, destroys workqueues to flush in-flight work before closing connections, refuses tipc_conn_lookup() after shutdown, and releases idr_lock when no connections remain to prevent pinning during teardown.

The vulnerability can lead to use-after-free conditions, race conditions, and kernel stalls in the TIPC subsystem, potentially causing kernel crashes or instability. There is no information about active exploitation in the wild.

A fix has been implemented upstream in the Linux kernel that changes the teardown order and adds safeguards to prevent workqueue use after destruction. Users should update to the fixed kernel version once available. Patch status is not yet confirmed for specific distributions; check vendor advisories for current remediation guidance.