Linux Kernel EUVD-2026-86927

Exploitation requires the target to have the TIPC (Transparent Inter-Process Communication) subsystem enabled and actively establishing links - the leak occurs specifically in the RESET/ACTIVATE link-protocol messages, where the interface name was written with strcpy() into a fixed TIPC_MAX_IF_NAME buffer, leaving trailing bytes populated with uninitialized skb memory. The attacker must be positioned to receive these TIPC link-protocol messages, i.e. act as or observe a TIPC peer on the cluster, which in practice means adjacency to the TIPC network rather than arbitrary internet reach. Limiting factors: TIPC is not enabled by default on most Linux installations and is used mainly in clustered/telecom environments; the disclosure is confined to a small, non-controllable set of padding bytes (C:L only), with no integrity or availability impact.

This is a genuinely low-priority issue despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) reflects an unauthenticated, remotely reachable information disclosure with only limited (C:L) confidentiality impact and no integrity or availability effect. All corroborating signals point the same direction and do not conflict: EPSS is 0.18% (7th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit or PoC is present - the only linked git.kernel.org references are the upstream fix commits, not exploit code. The vuln.today Decision label is 'this_month', consistent with a real-but-non-urgent fix. The one nuance to flag: although AV:N is defensible, TIPC is a clustering protocol typically run on a trusted cluster/adjacent L2 network rather than the open internet, and - critically - the flaw is only reachable when the TIPC subsystem is actually configured and links are being established, which is uncommon in general-purpose Linux deployments. The disclosure itself is small (uninitialized padding bytes from an skb within a TIPC_MAX_IF_NAME buffer leaked to a remote peer), so this is a high-reach product with a low-reach, low-impact bug rather than a high-CVSS-but-overstated emergency.

An attacker participating as a peer in a TIPC network (or able to inject TIPC link-protocol traffic onto the cluster segment) observes the RESET/ACTIVATE link-protocol messages a vulnerable node sends during link establishment. Because the interface name was copied with strcpy() instead of a fixed-length memcpy(), the bytes following the name within the fixed TIPC_MAX_IF_NAME buffer contain leftover uninitialized skb memory, which the attacker collects to recover fragments of kernel memory. No public exploit or PoC has been identified at time of analysis, and the small, non-deterministic nature of the leak limits practical value.