Executive brief
The TIPC (Transparent Inter-Process Communication) protocol in the Linux kernel is used for inter-node messaging in clustered environments. An attacker can send a malformed connection acknowledgment message with an inflated count that causes an integer underflow in the kernel, permanently blocking outbound messages on that connection and leading to denial of service.
Technical details
The vulnerability is an unsigned integer underflow in the tipc_sk_conn_proto_rcv() function in net/tipc/socket.c. When processing a CONN_ACK (connection acknowledgment) message, the code subtracts a peer-supplied ack count from the unsigned 16-bit snt_unacked counter without validating that the ack count does not exceed the actual number of outstanding messages. If an oversized ack count is received, the subtraction wraps around to a near-maximum value, causing tsk_conn_cong() to remain permanently true and starving the connection of further transmissions. The attack vector is network-based (a local peer or remote attacker on the TIPC network can send a crafted CONN_ACK message), and no authentication or user interaction is required. The fix validates the ack count before performing the subtraction and drops invalid messages.
Affected products
- Linux Linux kernel multiple versions (reportedly affecting 4.x through 6.x+ series)
Timeline
- 2026-08-15: disclosed
- 2026-06-10: patched: Upstream fix commit ab3e10b44ba5411779aac7afd2477917dd77750f