Linux TIPC Use-After-Free in Asynchronous Crypto Operations

CVE-2026-63801 is a slab-use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol implementation. The flaw occurs in tipc_aead_decrypt_done() when asynchronous cryptographic operations are offloaded to workers like cryptd. Unlike the encryption path, the decryption flow fails to maintain a reference on the network namespace before initiating crypto_aead_decrypt(). If the bearer's netns is torn down while the async operation is pending, the callback executes in a freed memory context, leading to use-after-free conditions. This vulnerability affects any Linux system using TIPC with hardware-accelerated or worker-queued crypto operations, potentially allowing local attackers to trigger kernel memory corruption and denial of service.

While CVE-2026-63801 lacks direct MITRE ATT&CK mapping, Casky's extended reasoning capabilities would identify this as a resource management and privilege escalation attack pattern. Practitioners using Casky would observe detections aligned with T1053 (Scheduled Task/Job) for async kernel worker execution patterns and T1040 (Network Sniffing) contexts where TIPC message decryption occurs. The platform's 754 mapped security skills enable detection of unsafe kernel object lifecycle management, reference counting bypasses, and namespace isolation breaks—all prerequisites for exploiting this flaw. Security teams would see findings related to memory safety violations and kernel state inconsistencies that precede use-after-free exploitation attempts.