The Linux kernel TIPC subsystem had a use-after-free vulnerability (CVE-2026-64543) in the UDP bearer implementation. The bearer_disable() function frees the discoverer object with a plain kfree(), but tipc_disc_rcv() can still dereference this freed object under RCU read lock during UDP packet reception. L2 bearers avoid this due to synchronize_net(), but UDP bearers defer cleanup, causing a race condition. The fix changes the freeing method to use kfree_rcu() with an RCU callback and adds an rcu_barrier() on module exit to prevent use-after-free of module text. The vulnerability is reachable from unprivileged user namespaces via the TIPCv2 generic netlink family, which lacks admin permission checks on bearer commands.

Successful exploitation can lead to use-after-free memory corruption in the kernel, potentially causing system crashes, denial of service, or escalation of privileges due to the high impact on confidentiality, integrity, and availability as indicated by the CVSS vector. The vulnerability is exploitable locally with low privileges in a user namespace environment where TIPC and UDP media are enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel source by changing the freeing mechanism to use RCU callbacks and adding synchronization barriers on module unload. Users should monitor official Linux kernel advisories and apply updates when available. No generic mitigations are specified by the vendor advisory.