Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74281

tipc: reject inverted service ranges from peer bindings

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc_update_nametbl() inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower <= upper. The local bind path validates the ordering (tipc_uaddr_valid()), but the name-distribution path does not. A binding with lower > upper is inserted at the far end of the service-range rbtree (keyed on lower) where no lookup or withdrawal can ever match it (service_range_foreach_match() requires sr->lower <= end). The publication, its service_range node and the augmented rbtree entry are then leaked for the lifetime of the namespace, and there is no per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings. Reject inverted ranges in the network path as well. A peer node can otherwise leak unbounded binding-table memory by sending PUBLICATION items with lower > upper.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 37922ea4a3105176357c8d565a9d982c4a08714a · fixed in cd1955f81bd8ebeef51b324989ac871ad1947fb6; From 37922ea4a3105176357c8d565a9d982c4a08714a · fixed in f683200b83a0085d4e11abea8c1fdd9fdfb95b0b; From 37922ea4a3105176357c8d565a9d982c4a08714a · fixed in f1715d92ee3095d9215b493a8603a81f646fcf61; From 37922ea4a3105176357c8d565a9d982c4a08714a · fixed in 581ef56e5c34d475056ce086dc2ba0e872ba6857; From 37922ea4a3105176357c8d565a9d982c4a08714a · fixed in 7e401233f9bb74a626e70698d0d62f3a94ac0676; From 37922ea4a3105176357c8d565a9d982c4a08714a · fixed in 973bf0ed896b9898668dbadb82ed849d7d573010; From 37922ea4a3105176357c8d565a9d982c4a08714a · fixed in 2afb648f7b99216c687db1f89739c995e1144153

  • Linux Linux

    4.17

  • KernelLinux

    From 4.17.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5

References 7

git.kernel.org