EUVD-2026-59428
GHSA-x4hp-m4vp-wc59
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Agrees with official vector: TIPC UDP bearers enable network-routable peer attacks with no authentication; impact is purely availability via unbounded memory leak.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tipc: reject inverted service ranges from peer bindings
tipc_update_nametbl() inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower <= upper. The local bind path validates the ordering (tipc_uaddr_valid()), but the name-distribution path does not.
A binding with lower > upper is inserted at the far end of the service-range rbtree (keyed on lower) where no lookup or withdrawal can ever match it (service_range_foreach_match() requires sr->lower <= end). The publication, its service_range node and the augmented rbtree entry are then leaked for the lifetime of the namespace, and there is no per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.
Reject inverted ranges in the network path as well. A peer node can otherwise leak unbounded binding-table memory by sending PUBLICATION items with lower > upper.
AnalysisAI
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | TIPC must be compiled and active on the victim kernel (CONFIG_TIPC enabled, a TIPC bearer configured and running). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) captures the availability-only impact with network-level accessibility - technically defensible because TIPC supports UDP bearers that can traverse routed networks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A compromised or malicious TIPC peer node on the cluster network sends a flood of PUBLICATION messages to a victim Linux host, each specifying a service range where the lower bound exceeds the upper bound. The victim kernel's tipc_update_nametbl() inserts each malformed entry into the service-range rbtree without validation, permanently leaking the associated publication structure and rbtree node. … |
| Remediation | Upgrade to a patched stable kernel release: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1, depending on the branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately identify all Linux systems with TIPC enabled-typically in clustering or high-availability deployments-within 24 hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today