CVE-2026-74281tipc: reject inverted service ranges from peer bindings
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc_update_nametbl() inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower <= upper. The local bind path validates the ordering (tipc_uaddr_valid()), but the name-distribution path does not. A binding with lower > upper is inserted at the far end of the service-range rbtree (keyed on lower) where no lookup or withdrawal can ever match it (service_range_foreach_match() requires sr->lower <= end). The publication, its service_range node and the augmented rbtree entry are then leaked for the lifetime of the namespace, and there is no per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings. Reject inverted ranges in the network path as well. A peer node can otherwise leak unbounded binding-table memory by sending PUBLICATION items with lower > upper.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 37922ea4a3105176357c8d565a9d982c4a08714a before cd1955f81bd8ebeef51b324989ac871ad1947fb6; from 37922ea4a3105176357c8d565a9d982c4a08714a before f683200b83a0085d4e11abea8c1fdd9fdfb95b0b; from 37922ea4a3105176357c8d565a9d982c4a08714a before f1715d92ee3095d9215b493a8603a81f646fcf61; 37922ea4a3105176357c8d565a9d982c4a08714a builds before 581ef56e5c34d475056ce086dc2ba0e872ba6857; 37922ea4a3105176357c8d565a9d982c4a08714a builds before 7e401233f9bb74a626e70698d0d62f3a94ac0676; 37922ea4a3105176357c8d565a9d982c4a08714a builds before 973bf0ed896b9898668dbadb82ed849d7d573010; 37922ea4a3105176357c8d565a9d982c4a08714a builds before 2afb648f7b99216c687db1f89739c995e1144153 | CNA record |
References
- https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6
- https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b
- https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61
- https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857
- https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676
- https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010
- https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.