CVE-2026-99054 tipc: destroy topsrv workqueues before closing connections
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99054?
CVE-2026-99054 is a high-severity vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tipc: destroy topsrv workqueues before closing connections
tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more work, and in-flight send/recv work could drop the last connection reference during the conn_idr walk.
That race produced several teardown failures: refcount_t addition on 0 from conn_get() on a connection whose release was blocked on idr_lock, a subsequent use-after-free in tipc_conn_close(), queue_work() on an already destroyed workqueue from the listener data-ready callback, and an RCU stall in tipc_topsrv_exit_net() while the walk spun under idr_lock.
Clear srv->listener under idr_lock so it acts as a shutdown flag, skip queue_work() once it is NULL, destroy the workqueues to flush in-flight work, and only then close the remaining connections. Refuse tipc_conn_lookup() after that flag is cleared, and drop idr_lock when the teardown walk finds no connection, so an in-flight subscription event cannot pin idr_in_use while the walk holds the lock.
v3 supersedes the narrower in-thread diff Tung Quang Nguyen posted on 2026-09-23. It keeps his teardown order and adds the lookup refusal and the empty-idr unlock.
Which versions are affected by CVE-2026-99054?
How do I fix CVE-2026-99054?
Upgrade to a fixed version.
Is CVE-2026-99054 being exploited?
There is no known exploitation of CVE-2026-99054 in the wild and no public exploit code.
Sources
Also known as AZL-110936, BELL-CVE-2026-99054, DEBIAN-CVE-2026-99054, GHSA-qw7p-7wvc-p5q5, UBUNTU-CVE-2026-99054.