{
  "threat_severity" : "Moderate",
  "public_date" : "2026-08-10T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create()",
    "id" : "2513397",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2513397"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ntipc: clear sock->sk on the failed-insert path in tipc_sk_create()\nWhen tipc_sk_create() fails to insert the new socket (tipc_sk_insert()\nreturns non-zero), its error path frees the sk with sk_free() but leaves\nsock->sk pointing at the freed object:\nif (tipc_sk_insert(tsk)) {\nsk_free(sk);\npr_warn(\"Socket create failed; port number exhausted\\n\");\nreturn -EINVAL;\n}\nThis is harmless for plain socket(): the syscall layer clears sock->ops\nbefore releasing, so tipc_release() is never called. It is not harmless\non the accept() path. tipc_accept() creates the pre-allocated child\nsocket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves\nnew_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then\nfput()s the new file, so __sock_release() -> tipc_release() runs\nlock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the\nsk_lock spinlock.\ntipc_release() already guards this exact \"failed accept() releases a\npre-allocated child\" case with \"if (sk == NULL) return 0;\", but the\nguard is bypassed because tipc_sk_create() left sock->sk non-NULL\n(dangling) rather than NULL.\nClear sock->sk on the failed-insert path so the existing tipc_release()\nNULL check fires and the use-after-free is avoided.\nThe tipc_sk_insert() failure is reached when the per-netns socket\nrhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M\nelements) -- i.e. once a netns holds ~2M TIPC sockets every insert\nreturns -E2BIG.\nBUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)\nWrite of size 8 at addr ffff8880047cdc38 by task init/1\nlock_sock_nested (net/core/sock.c:3839)\ntipc_release (net/tipc/socket.c:638)\n__sock_release (net/socket.c:710)\nsock_close (net/socket.c:1501)\n__fput (fs/file_table.c:512)\nAllocated by task 1:\nsk_alloc (net/core/sock.c:2308)\ntipc_sk_create (net/tipc/socket.c:487)\ntipc_accept (net/tipc/socket.c:2744)\ndo_accept (net/socket.c:2034)\nFreed by task 1:\n__sk_destruct (net/core/sock.c:2391)\ntipc_sk_create (net/tipc/socket.c:504)\ntipc_accept (net/tipc/socket.c:2744)\ndo_accept (net/socket.c:2034)", "A flaw was found in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol. A local attacker could exploit this vulnerability by repeatedly creating and failing to insert new sockets, causing the `tipc_sk_create()` function to leave a dangling pointer to a freed socket object. This use-after-free condition can lead to a system crash, resulting in a denial of service, or potentially allow for arbitrary code execution." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux for NVIDIA 26",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/a:redhat:enterprise_linux_nvidia:"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-68117\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68117\nhttps://lore.kernel.org/linux-cve-announce/2026081055-CVE-2026-68117-dd27@gregkh/T" ],
  "name" : "CVE-2026-68117",
  "csaw" : false
}