Executive brief
A vulnerability in the Linux kernel's TIPC networking protocol could allow a local user to crash the system. By setting a specific socket option to a very low value, an attacker can trigger a mathematical error that causes the operating system to stop responding (kernel panic). This affects the availability of the system but does not directly expose sensitive data.
Technical details
A divide-by-zero error exists in the tipc_sk_filter_connect() function within the TIPC (Transparent Inter-Process Communication) protocol implementation of the Linux kernel. A local attacker can use setsockopt(TIPC_CONN_TIMEOUT) to set the connection timeout to a value between 0 and 3. When a SYN packet is subsequently rejected with TIPC_ERR_OVERLOAD, the retry logic performs a modulo operation using (conn_timeout / 4) as the divisor. Because integer division of 0-3 by 4 results in zero, this triggers a kernel oops/panic. The fix involves clamping the conn_timeout to a minimum value of 4 during use.
Affected products
- Linux Linux Kernel 4.20 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-10: other: Vulnerability fixed in source code by Mehul Rao
- 2026-05-08: disclosed: CVE published
- 2026-05-08: advisory
References
- https://git.kernel.org/stable/c/2754e7b3d64748643df867d1ea6fec522914b635
- https://git.kernel.org/stable/c/338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3
- https://git.kernel.org/stable/c/3bc9998041076ee05d3f312a22cee6b2ca35527f
- https://git.kernel.org/stable/c/579956f9f297eb1b6a5d24de313f3acccee1f9d5
- https://git.kernel.org/stable/c/600feb0a66a98c6b7f6f02b5f3612e75f9b8540f
- https://git.kernel.org/stable/c/6c5a9baa15de240e747263aba435a0951da8d8d2
- https://git.kernel.org/stable/c/a360d3815aae1f00dd71b7714a846482e85cc1f7