Skip to content
Heist/ feed
Unrated

tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern. Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0 Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.

Announced Source revision 1
Original source ↗

CVE-2026-68289

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-68289

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
        "lessThan": "9fd4f92671146b068809b6c34b50346cb30cf8f7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
        "lessThan": "93580911f02d1f4a506ec0a6fc4354140c53ffe8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
        "lessThan": "1b6066313b9b8fac870483bf7a26d6bd56579747",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
        "lessThan": "7364014fdc289225229eb08de8bcbf4580e78e4d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
        "lessThan": "fe9bf32bb18f2d35789d4960fb007d1059bbaa38",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
        "lessThan": "47f42ff521b4eeb46e82f9a46a4783a99f7570d7",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/tipc/socket.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.12"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.12",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.189",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.111",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.53",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/tipc/socket.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-68289

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#8247 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement