CVE-2026-72404 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, users of Linux-based systems, and security teams responsible for vulnerability management and patching. These stakeholders should be aware of the vulnerability's impact on Linux kernel's TIPC UDP media bearer teardown and take necessary actions to mitigate the risk. This includes reviewing and applying patches, monitoring for suspicious activity, and implementing additional logging and monitoring measures. The vulnerability's resolution involves deferring dst_cache_destroy() and kfree() until after ensuring no more readers can see the bearer/socket and all existing readers have finished, which was achieved by using call_rcu_hurry() and synchronize_net(). Affected operators and platforms should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. The resolution ensures that no more readers can access the bearer/socket and all existing readers have finished, preventing further use-after-free errors and warnings. This requires coordination between Linux kernel developers, distribution maintainers, and users to ensure timely patching and mitigation of the vulnerability. The vulnerability's impact on Linux-based systems necessitates prompt attention from affected stakeholders to prevent potential crashes and warnings. By prioritizing patching and implementing compensating controls, stakeholders can minimize the risk associated with this vulnerability. Linux kernel developers and maintainers should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. The T

Technical summary

The Linux kernel's TIPC UDP media bearer teardown was vulnerable to a use-after-free attack. The dst_cache_destroy() function was called prematurely, allowing concurrent RCU readers to access freed memory. This led to crashes and warnings. The vulnerability was resolved by deferring dst_cache_destroy() and kfree() until after ensuring no more readers can see the bearer/socket and all existing readers have finished.

Defensive priority

High

Recommended defensive actions

• Apply the patch from https://git.kernel.org/stable/c/1c8393eefa3cadf4ca0b61119ad1321aa32d3c8c
• Apply the patch from https://git.kernel.org/stable/c/7116764ca53ff529335d7ab7c364a69f094b23a5
• Update Linux kernel to the latest version
• Monitor for suspicious network activity
• Implement additional logging and monitoring

Evidence notes

The vulnerability was resolved by deferring dst_cache_destroy() and kfree() until after ensuring no more readers can see the bearer/socket and all existing readers have finished. This was achieved by using call_rcu_hurry() and synchronize_net().

Official resources