Junglewise Threat Intelligence

CVE-2026-43411: Linux Kernel divide by zero in tipc_sk_filter_connect

CVE-2026-43411 · Severity: medium · CVSS 5.5 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's TIPC networking protocol could allow a local user to crash the system. By setting a specific socket option to a very low value, an attacker can trigger a mathematical error that causes the operating system to stop responding (kernel panic). This affects the availability of the system but does not directly expose sensitive data.

Technical details

A divide-by-zero error exists in the tipc_sk_filter_connect() function within the TIPC (Transparent Inter-Process Communication) protocol implementation of the Linux kernel. A local attacker can use setsockopt(TIPC_CONN_TIMEOUT) to set the connection timeout to a value between 0 and 3. When a SYN packet is subsequently rejected with TIPC_ERR_OVERLOAD, the retry logic performs a modulo operation using (conn_timeout / 4) as the divisor. Because integer division of 0-3 by 4 results in zero, this triggers a kernel oops/panic. The fix involves clamping the conn_timeout to a minimum value of 4 during use.

Affected products

  • Linux Linux Kernel 4.20 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3

Timeline

  • 2026-03-10: other: Vulnerability fixed in source code by Mehul Rao
  • 2026-05-08: disclosed: CVE published
  • 2026-05-08: advisory

References

Related threats