Skip to main content

Linux Kernel EUVDEUVD-2026-55398

| CVE-2026-68297 HIGH
2026-08-10 Linux GHSA-prmr-9j2x-c47h
Denial Of Service Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local exploitation via user namespace with CAP_NET_ADMIN confirmed (AV:L/PR:L); kernel panic confirmed for A:H; C:H/I:H retained for potential kernel memory corruption scope consistent with kernel-level divide-by-zero.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:39 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix u16 MTU truncation in media and bearer MTU validation

Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is silently truncated when assigned to u16 fields l->mtu and l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000) truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values (e.g. 65537-131071) produce small incorrect MTU values, resulting in link malfunction behaviors.

Crash stack (triggered as unprivileged user via user namespace):

tipc_link_set_queue_limits net/tipc/link.c:2531 tipc_link_create net/tipc/link.c:520 tipc_node_check_dest net/tipc/node.c:1279 tipc_disc_rcv net/tipc/discover.c:252 tipc_rcv net/tipc/node.c:2129 tipc_udp_recv net/tipc/udp_media.c:392

Two independent paths lack the upper bound check:

  1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
  2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)

Fix both by rejecting MTU values above U16_MAX.

AnalysisAI

Integer truncation in the Linux kernel TIPC subsystem allows low-privileged local attackers - including unprivileged users leveraging user namespaces - to crash the kernel via division by zero or trigger link malfunction. Two independent netlink code paths (TIPC_NL_MEDIA_SET via tipc_udp_mtu_bad() and TIPC_NL_BEARER_SET via bearer.c:1160) accept MTU values above U16_MAX (65535) without enforcing an upper bound, causing silent truncation when the values are stored in u16 fields in tipc_link_create(). No exploit code is publicly known and the vulnerability is not listed in CISA KEV; EPSS at 0.17% (6th percentile) confirms very low observed exploitation probability.

Technical ContextAI

TIPC (Transparent Inter-Process Communication) is a Linux kernel networking protocol used for intra-cluster communication, present since kernel 4.18 (CPE: cpe:2.3:a:linux:linux). The flaw is an integer type truncation bug analogous to CWE-190/CWE-681: the kernel allocates only 16 bits (u16) for l->mtu and l->advertised_mtu in tipc_link_create() (net/tipc/link.c:520), but both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET netlink interfaces accept 32-bit user-supplied MTU values and only validate a minimum, not a maximum. An MTU of 65536 (0x10000) wraps to 0 in the u16 assignment; when tipc_link_set_queue_limits() subsequently computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE), a divide-by-zero kernel panic results. Values in the range 65537-131071 produce small non-zero but incorrect MTU values, causing link malfunction rather than an immediate crash. No CWE is formally assigned in the NVD record, but the root cause is unambiguously integer truncation on assignment to a narrower unsigned type.

RemediationAI

Upgrade to a patched stable kernel release: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5, pulling the applicable fix commit from git.kernel.org for each branch (f02334a9, f4013598, 1b8fb5a2, c1cda72f, 9f29cd8a). The fix rejects MTU values above U16_MAX at validation time in both tipc_udp_mtu_bad() and __tipc_nl_bearer_set(), eliminating the truncation path. If immediate kernel patching is not feasible, blacklist the TIPC module by adding 'blacklist tipc' to /etc/modprobe.d/tipc-blacklist.conf and unloading the running module with 'modprobe -r tipc'; this eliminates the attack surface entirely but will break any TIPC-dependent cluster communication - verify no production workloads depend on TIPC before applying. As a secondary measure, disabling unprivileged user namespace creation (sysctl -w kernel.unprivileged_userns_clone=0 or equivalent) raises the exploitation bar to requiring an already-privileged account, though this has significant side effects for containerized and sandboxed workloads (Flatpak, Chrome, Firefox, container runtimes) and should be evaluated carefully.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55398 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy