CVE-2026-63801 (GCVE-0-2026-63801)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
Title
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the per-netns tipc_crypto, and the completion then reads it: tipc_aead_decrypt_done() dereferences aead->crypto->stats and aead->crypto->net, and tipc_crypto_rcv_complete() dereferences aead->crypto->aead[] and the node table -- reading freed memory. Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO): BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999) Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51 Workqueue: events_unbound Call Trace: tipc_aead_decrypt_done (net/tipc/crypto.c:999) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Allocated by task 169: __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) tipc_crypto_start (net/tipc/crypto.c:1502) tipc_init_net (net/tipc/core.c:72) ops_init (net/core/net_namespace.c:137) setup_net (net/core/net_namespace.c:446) copy_net_ns (net/core/net_namespace.c:579) create_new_namespaces (kernel/nsproxy.c:132) __x64_sys_unshare (kernel/fork.c:3316) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Freed by task 8: kfree (mm/slub.c:6566) tipc_exit_net (net/tipc/core.c:119) cleanup_net (net/core/net_namespace.c:704) process_one_work (kernel/workqueue.c:3314) kthread (kernel/kthread.c:436) This is the same class of bug that commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") fixed for the encrypt side. The encrypt path takes maybe_get_net(aead->crypto->net) before crypto_aead_encrypt() and drops it with put_net() on the synchronous return paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY return keeps the reference for the async callback to release. The decrypt path was left without the equivalent guard. Mirror the encrypt-side fix on the decrypt path: take a net reference before crypto_aead_decrypt() (failing with -ENODEV and the matching bearer put if it cannot be acquired), keep it across the -EINPROGRESS/-EBUSY async return, and drop it with put_net() on the synchronous success/error return and at the end of tipc_aead_decrypt_done(). Reproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is flooded with crafted encrypted frames from an unknown peer (driving the cluster-key decrypt path) while the bearer's netns is repeatedly torn down. The completion must run asynchronously to outlive tipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts synchronously, so the async path was exercised via cryptd offload. The unguarded aead->crypto dereference in tipc_aead_decrypt_done() is the unpatched upstream path; tipc_aead_decrypt() still lacks maybe_get_net(aead->crypto->net), so the completion can outlive the free on any config where crypto_aead_decrypt() goes async. Found by 0sec automated security-research tooling (https://0sec.ai).
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 171d31245d11bf84836fad3b394cb465a4d008ec (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 2d1f21419ec121232c916d3a3fc9b6766473a0e7 (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 0a780653b2a7569a7af9be7d0b00b1251baca63a (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < eaca7dae02fab70c8d223cffe03cec1b93249ce2 (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < dca7713fe044a2067387948557ea099056e1679e (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < e18769616fd5a90ec1e12aabbba544c488284292 (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < 1eea5e1820a2f5164d706bd1277bc97ff31ce32d (git)
Affected: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 , < bda3348872a2ef0d19f2df6aa8cb5025adce2f20 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.260 , ≤ 5.10.* (semver)
Unaffected: 5.15.211 , ≤ 5.15.* (semver)
Unaffected: 6.1.177 , ≤ 6.1.* (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "171d31245d11bf84836fad3b394cb465a4d008ec",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "2d1f21419ec121232c916d3a3fc9b6766473a0e7",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "0a780653b2a7569a7af9be7d0b00b1251baca63a",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "eaca7dae02fab70c8d223cffe03cec1b93249ce2",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "dca7713fe044a2067387948557ea099056e1679e",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "e18769616fd5a90ec1e12aabbba544c488284292",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "1eea5e1820a2f5164d706bd1277bc97ff31ce32d",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            },
            {
              "lessThan": "bda3348872a2ef0d19f2df6aa8cb5025adce2f20",
              "status": "affected",
              "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix slab-use-after-free Read in tipc_aead_decrypt_done\n\ntipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to\ncrypto_aead_decrypt(req) without taking a reference on the netns, unlike\nthe encrypt path. When crypto_aead_decrypt() is offloaded asynchronously\n(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs\ntipc_aead_decrypt_done() later. If the bearer\u0027s netns is torn down in the\nmeantime, cleanup_net() -\u003e tipc_exit_net() -\u003e tipc_crypto_stop() frees the\nper-netns tipc_crypto, and the completion then reads it:\ntipc_aead_decrypt_done() dereferences aead-\u003ecrypto-\u003estats and\naead-\u003ecrypto-\u003enet, and tipc_crypto_rcv_complete() dereferences\naead-\u003ecrypto-\u003eaead[] and the node table -- reading freed memory.\n\nDecoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):\n\n  BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n  Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51\n  Workqueue: events_unbound\n  Call Trace:\n   tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n   process_one_work (kernel/workqueue.c:3314)\n   worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n  Allocated by task 169:\n   __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n   tipc_crypto_start (net/tipc/crypto.c:1502)\n   tipc_init_net (net/tipc/core.c:72)\n   ops_init (net/core/net_namespace.c:137)\n   setup_net (net/core/net_namespace.c:446)\n   copy_net_ns (net/core/net_namespace.c:579)\n   create_new_namespaces (kernel/nsproxy.c:132)\n   __x64_sys_unshare (kernel/fork.c:3316)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n  Freed by task 8:\n   kfree (mm/slub.c:6566)\n   tipc_exit_net (net/tipc/core.c:119)\n   cleanup_net (net/core/net_namespace.c:704)\n   process_one_work (kernel/workqueue.c:3314)\n   kthread (kernel/kthread.c:436)\n\nThis is the same class of bug that commit e279024617134 (\"net/tipc: fix\nslab-use-after-free Read in tipc_aead_encrypt_done\") fixed for the encrypt\nside. The encrypt path takes maybe_get_net(aead-\u003ecrypto-\u003enet) before\ncrypto_aead_encrypt() and drops it with put_net() on the synchronous\nreturn paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY\nreturn keeps the reference for the async callback to release. The decrypt\npath was left without the equivalent guard.\n\nMirror the encrypt-side fix on the decrypt path: take a net reference\nbefore crypto_aead_decrypt() (failing with -ENODEV and the matching\nbearer put if it cannot be acquired), keep it across the\n-EINPROGRESS/-EBUSY async return, and drop it with put_net() on the\nsynchronous success/error return and at the end of\ntipc_aead_decrypt_done().\n\nReproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is\nflooded with crafted encrypted frames from an unknown peer (driving the\ncluster-key decrypt path) while the bearer\u0027s netns is repeatedly torn\ndown. The completion must run asynchronously to outlive\ntipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts\nsynchronously, so the async path was exercised via cryptd offload. The\nunguarded aead-\u003ecrypto dereference in tipc_aead_decrypt_done() is the\nunpatched upstream path; tipc_aead_decrypt() still lacks\nmaybe_get_net(aead-\u003ecrypto-\u003enet), so the completion can outlive the free\non any config where crypto_aead_decrypt() goes async.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead-\u003ecrypto-\u003estats, aead-\u003ecrypto-\u003enet, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:06.693Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/171d31245d11bf84836fad3b394cb465a4d008ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d1f21419ec121232c916d3a3fc9b6766473a0e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a780653b2a7569a7af9be7d0b00b1251baca63a"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaca7dae02fab70c8d223cffe03cec1b93249ce2"
        },
        {
          "url": "https://git.kernel.org/stable/c/dca7713fe044a2067387948557ea099056e1679e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e18769616fd5a90ec1e12aabbba544c488284292"
        },
        {
          "url": "https://git.kernel.org/stable/c/1eea5e1820a2f5164d706bd1277bc97ff31ce32d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bda3348872a2ef0d19f2df6aa8cb5025adce2f20"
        }
      ],
      "title": "tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63801",
    "datePublished": "2026-07-19T12:02:07.457Z",
    "dateReserved": "2026-07-19T07:54:57.013Z",
    "dateUpdated": "2026-08-17T04:51:06.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63801",
      "date": "2026-09-23",
      "epss": "0.00513",
      "percentile": "0.42735"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-14T17:55:34.000Z",
      "cve": "CVE-2026-63801",
      "id": "msrc_CVE-2026-63801",
      "initial_release_date": "2026-07-20T01:07:32.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63801.json",
      "version": "7"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/crypto.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "171d31245d11bf84836fad3b394cb465a4d008ec",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2d1f21419ec121232c916d3a3fc9b6766473a0e7",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a780653b2a7569a7af9be7d0b00b1251baca63a",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eaca7dae02fab70c8d223cffe03cec1b93249ce2",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dca7713fe044a2067387948557ea099056e1679e",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e18769616fd5a90ec1e12aabbba544c488284292",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1eea5e1820a2f5164d706bd1277bc97ff31ce32d",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bda3348872a2ef0d19f2df6aa8cb5025adce2f20",
                    "status": "affected",
                    "version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/crypto.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.260",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.211",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.177",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.144",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2AFCD09A-D441-4F56-AAFC-4787E48FED22",
                    "versionEndExcluding": "5.10.260",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D71C101E-388C-4A46-BD99-49049F7C5CFF",
                    "versionEndExcluding": "5.15.211",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "333C9E30-7FD4-46A2-94EF-C1AA1F3EE28B",
                    "versionEndExcluding": "6.1.177",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C8AD3BC8-C843-423C-B9DB-CB52F67F578E",
                    "versionEndExcluding": "6.6.144",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8",
                    "versionEndExcluding": "6.12.95",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A",
                    "versionEndExcluding": "6.18.38",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E",
                    "versionEndExcluding": "7.1.3",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix slab-use-after-free Read in tipc_aead_decrypt_done\n\ntipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to\ncrypto_aead_decrypt(req) without taking a reference on the netns, unlike\nthe encrypt path. When crypto_aead_decrypt() is offloaded asynchronously\n(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs\ntipc_aead_decrypt_done() later. If the bearer\u0027s netns is torn down in the\nmeantime, cleanup_net() -\u003e tipc_exit_net() -\u003e tipc_crypto_stop() frees the\nper-netns tipc_crypto, and the completion then reads it:\ntipc_aead_decrypt_done() dereferences aead-\u003ecrypto-\u003estats and\naead-\u003ecrypto-\u003enet, and tipc_crypto_rcv_complete() dereferences\naead-\u003ecrypto-\u003eaead[] and the node table -- reading freed memory.\n\nDecoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):\n\n  BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n  Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51\n  Workqueue: events_unbound\n  Call Trace:\n   tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n   process_one_work (kernel/workqueue.c:3314)\n   worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n  Allocated by task 169:\n   __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n   tipc_crypto_start (net/tipc/crypto.c:1502)\n   tipc_init_net (net/tipc/core.c:72)\n   ops_init (net/core/net_namespace.c:137)\n   setup_net (net/core/net_namespace.c:446)\n   copy_net_ns (net/core/net_namespace.c:579)\n   create_new_namespaces (kernel/nsproxy.c:132)\n   __x64_sys_unshare (kernel/fork.c:3316)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n  Freed by task 8:\n   kfree (mm/slub.c:6566)\n   tipc_exit_net (net/tipc/core.c:119)\n   cleanup_net (net/core/net_namespace.c:704)\n   process_one_work (kernel/workqueue.c:3314)\n   kthread (kernel/kthread.c:436)\n\nThis is the same class of bug that commit e279024617134 (\"net/tipc: fix\nslab-use-after-free Read in tipc_aead_encrypt_done\") fixed for the encrypt\nside. The encrypt path takes maybe_get_net(aead-\u003ecrypto-\u003enet) before\ncrypto_aead_encrypt() and drops it with put_net() on the synchronous\nreturn paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY\nreturn keeps the reference for the async callback to release. The decrypt\npath was left without the equivalent guard.\n\nMirror the encrypt-side fix on the decrypt path: take a net reference\nbefore crypto_aead_decrypt() (failing with -ENODEV and the matching\nbearer put if it cannot be acquired), keep it across the\n-EINPROGRESS/-EBUSY async return, and drop it with put_net() on the\nsynchronous success/error return and at the end of\ntipc_aead_decrypt_done().\n\nReproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is\nflooded with crafted encrypted frames from an unknown peer (driving the\ncluster-key decrypt path) while the bearer\u0027s netns is repeatedly torn\ndown. The completion must run asynchronously to outlive\ntipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts\nsynchronously, so the async path was exercised via cryptd offload. The\nunguarded aead-\u003ecrypto dereference in tipc_aead_decrypt_done() is the\nunpatched upstream path; tipc_aead_decrypt() still lacks\nmaybe_get_net(aead-\u003ecrypto-\u003enet), so the completion can outlive the free\non any config where crypto_aead_decrypt() goes async.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
          }
        ],
        "id": "CVE-2026-63801",
        "lastModified": "2026-08-17T05:17:16.550",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T12:16:52.680",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0a780653b2a7569a7af9be7d0b00b1251baca63a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/171d31245d11bf84836fad3b394cb465a4d008ec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1eea5e1820a2f5164d706bd1277bc97ff31ce32d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2d1f21419ec121232c916d3a3fc9b6766473a0e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bda3348872a2ef0d19f2df6aa8cb5025adce2f20"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dca7713fe044a2067387948557ea099056e1679e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e18769616fd5a90ec1e12aabbba544c488284292"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eaca7dae02fab70c8d223cffe03cec1b93249ce2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T11:47:51+00:00",
      "cve": "CVE-2026-63801",
      "id": "CVE-2026-63801",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:fixed": "453",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63801.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-23T17:04:28Z",
      "cve": "CVE-2026-63801",
      "id": "CVE-2026-63801",
      "initial_release_date": "2026-07-19T17:35:05Z",
      "product_status:first_fixed": "167",
      "product_status:known_affected": "544",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "245",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63801",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63801.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.