Executive brief
The Linux kernel's TIPC (Tiered Inter-Process Communication) protocol implementation contains an integer overflow vulnerability during link MTU (Maximum Transmission Unit) negotiation. A malicious remote peer can send a specially crafted message with an extremely small MTU value, causing the kernel to calculate an incorrect MTU that leads to excessive memory allocation, denial of service, and potential system crash.
Technical details
The vulnerability is an integer overflow in TIPC MTU negotiation when processing Activate messages. When a peer sends an Activate message with a very small MTU value (e.g., 4 bytes), the kernel fails to validate this against minimum MTU requirements. This causes tipc_link.mtu to be set to the small value, which then leads to an integer underflow in tipc_link_mss() when calculating (mtu - INT_H_SIZE - EMSG_OVERHEAD), wrapping around to 4294967228. The overflow manifests when huge skb allocations occur in named_distribute(), leading to kernel crashes during cleanup. The attack requires network reachability to send TIPC protocol messages. A patch has been released that validates new MTU values against tipc_bearer_min_mtu() before updating the link MTU.
Affected products
- Linux Linux kernel multiple versions prior to fix
Timeline
- 2025-10-01: disclosed