In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name()… (CVE-2026-99053)

The Linux kernel's TIPC subsystem had a vulnerability where tipc_node_find_by_name() returned a node pointer after releasing its RCU read lock without incrementing the node's reference count. This allowed concurrent operations, such as LINK_SET, LINK_GET, and LINK_RESET_STATS handlers, to access a node that might have been freed by a timer-driven cleanup routine (tipc_node_timeout). The race condition could lead to use-after-free scenarios, causing kernel memory corruption. The fix involved acquiring a reference to the node with kref_get_unless_zero() before leaving the RCU read lock and releasing that reference after the last access, including during packet transmission in LINK_SET. This preserves the existing locking and error handling order while preventing use-after-free.

The vulnerability could lead to kernel memory corruption due to use-after-free conditions in the TIPC subsystem. This can cause system instability, crashes, or potential privilege escalation if exploited. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel that ensures a reference is held on nodes returned by tipc_node_find_by_name() before leaving the RCU read lock, preventing use-after-free. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.