CVE-2026-98098

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipc_named_node_up() on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry (publication) into the TIPC name table. If the number of these publications exceeds TIPC_MAX_PUBL (65535), protocol service types (such as node state and link state) are no longer inserted into the name table. This causes two issues: 1. User-space applications subscribing to node or link up/down events stop receiving notifications. 2. A NULL pointer dereference can occur: BUG: kernel NULL pointer dereference, address: 00000000000000d0 ... CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc4-default+ #5 PREEMPT(full) ... RIP: 0010:tipc_named_node_up (./include/linux/skbuff.h:2251 net/tipc/name_distr.c:195 net/tipc/name_distr.c:221) ... Call Trace: <IRQ> tipc_node_write_unlock (net/tipc/node.c:428) tipc_rcv (net/tipc/node.c:934 net/tipc/node.c:2189) tipc_udp_recv (net/tipc/udp_media.c:389) Thread 1 (tipc_net_finalize) | Thread 2 (named_distribute) -----------------------------|----------------------------- | ... | list_for_each_entry(publ, pls, binding_node) { | ... | __skb_queue_tail(list, skb); | ... | } | ... | hdr = buf_msg(skb_peek_tail(list)); ... | tipc_nametbl_publish(); | If 'tipc_nametbl_publish()' (Thread 1) fails because the number of local publications reaches TIPC_MAX_PUBL, list (Thread 2) will be empty. As a result, NULL is passed to 'buf_msg()', leading to a NULL pointer dereference. Fix these issues by allowing protocol service types (node state, link state, and topology server) to be inserted into the name table unconditionally. This ensures that users subscribing to these types always receive notifications. In addition, the maximum number of local user publications is reduced to (TIPC_MAX_PUBL - 1). This ensures that the maximum bulk size calculated in tipc_link_set_queue_limits() remains valid.

• https://git.kernel.org/stable/c/68619f965329d2f7b113a3d5811aa23198f39105
• https://git.kernel.org/stable/c/ad805326d874062f8bc72a94884f86046148cde3
• https://git.kernel.org/stable/c/b3b76e9f4f2476f1135b2ba7743a821db4a0df4b
• https://git.kernel.org/stable/c/d0d82f1214f321143c5dbc2e48e4a4e6c4226895

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-98092In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98093In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98094In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98095In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98096In the Linux kernel, the following vulnerability has been re…7.4
• CVE-2026-98097In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98099In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9810The AI Copilot WordPress plugin before 1.5.4 does not bind …9.8
• CVE-2026-98101In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98102In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98103In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98104In the Linux kernel, the following vulnerability has been re…