CVE-2026-31662tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2f487712b89376fce267223bbb0db93d393d4b09 before a7db57ccca21f5801609065473c89a38229ecb92; from 2f487712b89376fce267223bbb0db93d393d4b09 before 36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412; from 2f487712b89376fce267223bbb0db93d393d4b09 before 575faea557f1a184a5f09661bd47ebd3ef3769f8; from 2f487712b89376fce267223bbb0db93d393d4b09 before 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3; from 2f487712b89376fce267223bbb0db93d393d4b09 before a2ea1ef0167d7a84730638d05c20ccdc421b14b6; 2f487712b89376fce267223bbb0db93d393d4b09 builds before 1b6f13f626665cac67ba5a012765427680518711; from 2f487712b89376fce267223bbb0db93d393d4b09 before e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682; from 2f487712b89376fce267223bbb0db93d393d4b09 before 48a5fe38772b6f039522469ee6131a67838221a8 | CNA record |
linux linux_kernel linux:linux_kernel | from 4.15.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.169; from 6.2 before 6.6.135; from 6.7 before 6.12.82; from 6.13 before 6.18.23; from 6.19 before 6.19.13; 4.15; and 7 more ranges | NVD |
References
- https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92patch
- https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412patch
- https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8patch
- https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3patch
- https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6patch
- https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711patch
- https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682patch
- https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.