EUVD-2026-59429
GHSA-5xv7-x5qx-3wv4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
TIPC peers require no kernel privileges to send CONN_ACK; impact is availability-only on affected connection with no confidentiality or integrity consequence.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tipc: prevent snt_unacked underflow on CONN_ACK
tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt_unacked without checking that it does not exceed the number of messages actually outstanding:
tsk->snt_unacked -= msg_conn_ack(hdr);
msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK message. If the ack count is larger than snt_unacked, the subtraction wraps to a near-maximum value, leaving tsk_conn_cong() permanently true and starving the connection of further transmits.
Validate the ACK count at the start of the CONN_ACK block and drop the message if it acknowledges more messages than are outstanding. A peer (or, for a local connection, the connected peer socket) can otherwise wedge a TIPC connection's send side by sending an oversized connection ack.
AnalysisAI
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Linux kernel TIPC module (tipc.ko) must be loaded and active on the victim system - TIPC is not enabled by default in all distributions and must be explicitly used or loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 7.5, reflecting that a network peer can trigger the condition without kernel-level authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who controls or has compromised a TIPC peer node in the same cluster - or any system able to establish a TIPC connection to the victim - initiates a connection, then sends a crafted CONN_ACK protocol message whose acknowledgment count field is set to a value larger than the victim kernel's current snt_unacked counter. The victim kernel applies the unchecked subtraction, wrapping snt_unacked to near-65535, after which all subsequent transmit attempts on that TIPC connection are permanently blocked due to the perpetually reported congestion state. … |
| Remediation | The primary fix is to upgrade to a patched Linux kernel release: 5.10.261 or later for the 5.10.x series, 5.15.212 or later for 5.15.x, 6.1.178 or later for 6.1.x, 6.6.145 or later for 6.6.x, 6.12.97 or later for 6.12.x, 6.18.40 or later for 6.18.x, or 7.1.5 or later for 7.1.x. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux systems using TIPC in production environments and assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today