CVE-2026-74255

CVE-2026-74255 is a use-after-free in the TIPC bearer layer where b->media_ptr remains valid across an RCU grace period, allowing concurrent readers to access a freed network device. The vulnerability lives in tipc_disable_l2_media(), which calls synchronize_net() while media_ptr still points to a valid device. After synchronize_net() returns, the device can be freed but the pointer isn't cleared until later — creating a race window where RCU readers can grab the dangling pointer. The root cause is a call-order dependency that emerged over time. An earlier commit reversed the order of operations in bearer_disable(), placing tipc_node_delete_links() before disable_media(). This was correct for bearer packet filtering, but it introduced an implicit requirement: tipc_node_delete_links() depends on media_ptr remaining valid through its execution. The reversal changed the synchronization contract without documenting the dependency. The fix is straightforward — clear media_ptr before calling synchronize_net() — but this works only because the call order was already reversed upstream. The broader pattern here is the kernel's inability to track synchronization invariants across function call boundaries. RCU correctness depends on knowing which pointers must remain valid through which barriers, yet this knowledge lives as tribal knowledge in commit messages and bug comments, not as explicit dependencies the review process can catch. Call-order changes in RCU-adjacent paths don't trigger any automated detection. Defenders should audit TIPC bearer paths and similar networking code for patterns where a function acquires a reference, synchronize_net() or similar RCU barriers are called, and the reference is cleared afterward. Check for any refactoring commits that reordered function calls in these paths — the fix for this CVE depends on knowing that upstream order reversal happened. Prioritize code paths with device pointers that cross synchronization boundaries, as these are the most likely locations for latent UAFs of this pattern.

Reviewed through automated stages and approved by a human before publication.