CVE-2026-74282
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt_unacked underflow on CONN_ACK tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt_unacked without checking that it does not exceed the number of messages actually outstanding: tsk->snt_unacked -= msg_conn_ack(hdr); msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK message. If the ack count is larger than snt_unacked, the subtraction wraps to a near-maximum value, leaving tsk_conn_cong() permanently true and starving the connection of further transmits. Validate the ACK count at the start of the CONN_ACK block and drop the message if it acknowledges more messages than are outstanding. A peer (or, for a local connection, the connected peer socket) can otherwise wedge a TIPC connection's send side by sending an oversized connection ack.
How to fix
- Linux Linux3388145d258cf2c4c98278e3987296007d30672e, 67e55b054bf8025658dc0e255057f2a6236416bd, 96f91b8ae1a489b3eca137e7acf42cf985fb8939, 47ed873e4ceda34098bd46d8e96b4bb13cad3a04, b44bebdd32c9ff66ee2aebfc317ced44bedd9335, 3cfa3d8e0dc167850edeb5bf5a07757db83fd54e, 1e2c956745777e6ffdee7f30da5935741c03ee1e, ab3e10b44ba5411779aac7afd2477917dd77750f or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < 3388145d258cf2c4c98278e3987296007d30672e, 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < 67e55b054bf8025658dc0e255057f2a6236416bd, 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < 96f91b8ae1a489b3eca137e7acf42cf985fb8939, 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < 47ed873e4ceda34098bd46d8e96b4bb13cad3a04, 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < b44bebdd32c9ff66ee2aebfc317ced44bedd9335, 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < 3cfa3d8e0dc167850edeb5bf5a07757db83fd54e, 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < 1e2c956745777e6ffdee7f30da5935741c03ee1e, 10724cc7bb7832b482df049c20fd824d928c5eaa ≤ v < ab3e10b44ba5411779aac7afd2477917dd77750f, 4.7 | 3388145d258cf2c4c98278e3987296007d30672e, 67e55b054bf8025658dc0e255057f2a6236416bd, 96f91b8ae1a489b3eca137e7acf42cf985fb8939, 47ed873e4ceda34098bd46d8e96b4bb13cad3a04, b44bebdd32c9ff66ee2aebfc317ced44bedd9335, 3cfa3d8e0dc167850edeb5bf5a07757db83fd54e, 1e2c956745777e6ffdee7f30da5935741c03ee1e, ab3e10b44ba5411779aac7afd2477917dd77750f |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.