CVE-2026-74282 (GCVE-0-2026-74282)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
tipc: prevent snt_unacked underflow on CONN_ACK
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt_unacked underflow on CONN_ACK tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt_unacked without checking that it does not exceed the number of messages actually outstanding: tsk->snt_unacked -= msg_conn_ack(hdr); msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK message. If the ack count is larger than snt_unacked, the subtraction wraps to a near-maximum value, leaving tsk_conn_cong() permanently true and starving the connection of further transmits. Validate the ACK count at the start of the CONN_ACK block and drop the message if it acknowledges more messages than are outstanding. A peer (or, for a local connection, the connected peer socket) can otherwise wedge a TIPC connection's send side by sending an oversized connection ack.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < 3388145d258cf2c4c98278e3987296007d30672e (git)
Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < 67e55b054bf8025658dc0e255057f2a6236416bd (git)
Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < 96f91b8ae1a489b3eca137e7acf42cf985fb8939 (git)
Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < 47ed873e4ceda34098bd46d8e96b4bb13cad3a04 (git)
Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < b44bebdd32c9ff66ee2aebfc317ced44bedd9335 (git)
Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < 3cfa3d8e0dc167850edeb5bf5a07757db83fd54e (git)
Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < 1e2c956745777e6ffdee7f30da5935741c03ee1e (git)
Affected: 10724cc7bb7832b482df049c20fd824d928c5eaa , < ab3e10b44ba5411779aac7afd2477917dd77750f (git)
Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3388145d258cf2c4c98278e3987296007d30672e",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            },
            {
              "lessThan": "67e55b054bf8025658dc0e255057f2a6236416bd",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            },
            {
              "lessThan": "96f91b8ae1a489b3eca137e7acf42cf985fb8939",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            },
            {
              "lessThan": "47ed873e4ceda34098bd46d8e96b4bb13cad3a04",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            },
            {
              "lessThan": "b44bebdd32c9ff66ee2aebfc317ced44bedd9335",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            },
            {
              "lessThan": "3cfa3d8e0dc167850edeb5bf5a07757db83fd54e",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            },
            {
              "lessThan": "1e2c956745777e6ffdee7f30da5935741c03ee1e",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            },
            {
              "lessThan": "ab3e10b44ba5411779aac7afd2477917dd77750f",
              "status": "affected",
              "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent snt_unacked underflow on CONN_ACK\n\ntipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count\nfrom the unsigned 16-bit send counter snt_unacked without checking that it\ndoes not exceed the number of messages actually outstanding:\n\n\ttsk-\u003esnt_unacked -= msg_conn_ack(hdr);\n\nmsg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK\nmessage. If the ack count is larger than snt_unacked, the subtraction\nwraps to a near-maximum value, leaving tsk_conn_cong() permanently true\nand starving the connection of further transmits.\n\nValidate the ACK count at the start of the CONN_ACK block and drop the\nmessage if it acknowledges more messages than are outstanding. A peer (or,\nfor a local connection, the connected peer socket) can otherwise wedge a\nTIPC connection\u0027s send side by sending an oversized connection ack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is reached when tipc_rcv() processes a remote CONN_MANAGER/CONN_ACK skb from a TIPC bearer (UDP port 6118 or Ethernet), traversing tipc_link_rcv()\u2192tipc_sk_rcv()\u2192tipc_sk_proto_rcv()\u2192tipc_sk_conn_proto_rcv() with attacker-controlled ack count.\nAC:L - After a normal TIPC connect handshake, the connected peer can send a single CONN_ACK whose msg_conn_ack() exceeds snt_unacked; no races, timing, or rare layout conditions are needed and the malicious field is fully attacker-controlled.\nPR:N - Exploitation only requires becoming the established TIPC peer via a standard AF_TIPC connect/listen handshake; socket creation needs no capabilities and the protocol has no authentication gate before CONN_ACK processing.\nUI:N - No victim user action is required beyond the service already accepting TIPC connections; the attacker triggers the bug by sending one crafted CONN_ACK on the established connection.\nS:U - Impact is limited to corrupting flow-control state on a victim TIPC socket within the same kernel/host security boundary; there is no VM escape, container breakout, or IOMMU boundary crossing.\nC:N - The unsigned 16-bit underflow only corrupts the snt_unacked congestion counter and does not read or disclose kernel memory, pointers, or other sensitive information.\nI:N - The bug modifies only an internal send-window counter to block transmits and provides no arbitrary write, code execution, or user/kernel data modification primitive.\nA:H - An oversized CONN_ACK wraps snt_unacked to a near-maximum value, leaving tsk_conn_cong() permanently true and indefinitely starving the victim socket\u0027s transmit path until the connection is torn down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:23.387Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3388145d258cf2c4c98278e3987296007d30672e"
        },
        {
          "url": "https://git.kernel.org/stable/c/67e55b054bf8025658dc0e255057f2a6236416bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/96f91b8ae1a489b3eca137e7acf42cf985fb8939"
        },
        {
          "url": "https://git.kernel.org/stable/c/47ed873e4ceda34098bd46d8e96b4bb13cad3a04"
        },
        {
          "url": "https://git.kernel.org/stable/c/b44bebdd32c9ff66ee2aebfc317ced44bedd9335"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cfa3d8e0dc167850edeb5bf5a07757db83fd54e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e2c956745777e6ffdee7f30da5935741c03ee1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab3e10b44ba5411779aac7afd2477917dd77750f"
        }
      ],
      "title": "tipc: prevent snt_unacked underflow on CONN_ACK",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74282",
    "datePublished": "2026-08-15T05:57:52.048Z",
    "dateReserved": "2026-08-15T05:44:03.880Z",
    "dateUpdated": "2026-08-17T05:45:23.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74282",
      "date": "2026-10-02",
      "epss": "0.00716",
      "percentile": "0.52108"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/socket.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3388145d258cf2c4c98278e3987296007d30672e",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67e55b054bf8025658dc0e255057f2a6236416bd",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96f91b8ae1a489b3eca137e7acf42cf985fb8939",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47ed873e4ceda34098bd46d8e96b4bb13cad3a04",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b44bebdd32c9ff66ee2aebfc317ced44bedd9335",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3cfa3d8e0dc167850edeb5bf5a07757db83fd54e",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1e2c956745777e6ffdee7f30da5935741c03ee1e",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ab3e10b44ba5411779aac7afd2477917dd77750f",
                    "status": "affected",
                    "version": "10724cc7bb7832b482df049c20fd824d928c5eaa",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/socket.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent snt_unacked underflow on CONN_ACK\n\ntipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count\nfrom the unsigned 16-bit send counter snt_unacked without checking that it\ndoes not exceed the number of messages actually outstanding:\n\n\ttsk-\u003esnt_unacked -= msg_conn_ack(hdr);\n\nmsg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK\nmessage. If the ack count is larger than snt_unacked, the subtraction\nwraps to a near-maximum value, leaving tsk_conn_cong() permanently true\nand starving the connection of further transmits.\n\nValidate the ACK count at the start of the CONN_ACK block and drop the\nmessage if it acknowledges more messages than are outstanding. A peer (or,\nfor a local connection, the connected peer socket) can otherwise wedge a\nTIPC connection\u0027s send side by sending an oversized connection ack."
          }
        ],
        "id": "CVE-2026-74282",
        "lastModified": "2026-08-17T06:19:21.987",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:27.660",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1e2c956745777e6ffdee7f30da5935741c03ee1e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3388145d258cf2c4c98278e3987296007d30672e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3cfa3d8e0dc167850edeb5bf5a07757db83fd54e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47ed873e4ceda34098bd46d8e96b4bb13cad3a04"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67e55b054bf8025658dc0e255057f2a6236416bd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/96f91b8ae1a489b3eca137e7acf42cf985fb8939"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ab3e10b44ba5411779aac7afd2477917dd77750f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b44bebdd32c9ff66ee2aebfc317ced44bedd9335"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T15:18:59+00:00",
      "cve": "CVE-2026-74282",
      "id": "CVE-2026-74282",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: prevent snt_unacked underflow on CONN_ACK",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74282.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.