RE: [syzbot] [tipc?] general protection fault in tipc_named_node_up

Looking through the source code, I came across this section in named_distribute():
while (item_cnt < ITEM_BULK_SIZE) {
      if (!skb_peek(list)) {
              msg_set_link_selector(buf_msg(skb_peek_tail(list)),
                                    dest & 1);
              break;
      }

Not sure what kernel version you referred to. But the latest kernel version does not have above code.

Possible fix
I tried a NULL check around the problematic access, and syzbot successfully tested that form of change. 

It is not a fix. It hides the bug and breaks user applications. User applications at remote peers  must be informed about node-up event.

However, I am unsure whether simply avoiding the dereference is the right fix. From reading the code, I wondered whether an empty message might still need to be sent to indicate that the initial name distribution has finished. 

Sending an empty message is a wrong approach and will break user applications at remote peers.

Relationship to CVE-2026-98098

I found CVE-2026-98098 after completing these tests. It reaches the same NULL dereference when publication exhaustion prevents the node-state publication from being inserted. 

That is one 3 scenarios causing  NULL dereference. I decided to split my original patch into smaller patches. One of them to address CVE-2026-98098.
The 2 remaining scenarios (one of them was reported by syzbot) are being addressed via:
https://lore.kernel.org/all/20261028033722.125477-3-tung.quang.nguyen@est.tech/ (local)

Does my explanation of the NULL dereference seem reasonable?

No, it does not.