{"id":"CVE-2026-31662","state":"PUBLISHED","title":"tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path.","publishedAt":"2026-04-24T14:45:12.593Z","updatedAt":"2026-10-19T18:56:02.280Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"a7db57ccca21f5801609065473c89a38229ecb92","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"575faea557f1a184a5f09661bd47ebd3ef3769f8","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"3bcf7aca63f0bcd679ae28e9b99823c608e59ce3","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"a2ea1ef0167d7a84730638d05c20ccdc421b14b6","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"1b6f13f626665cac67ba5a012765427680518711","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"48a5fe38772b6f039522469ee6131a67838221a8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/group.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.169","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.135","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.82","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.23","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.13","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/group.c"]}],"references":["https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92","https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412","https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8","https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3","https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6","https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711","https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682","https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31662.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31662","state":"PUBLISHED","datePublished":"2026-04-24T14:45:12.593Z","dateUpdated":"2026-10-19T18:56:02.280Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.129Z"},"containers":{"cna":{"title":"tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"a7db57ccca21f5801609065473c89a38229ecb92","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"575faea557f1a184a5f09661bd47ebd3ef3769f8","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"3bcf7aca63f0bcd679ae28e9b99823c608e59ce3","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"a2ea1ef0167d7a84730638d05c20ccdc421b14b6","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"1b6f13f626665cac67ba5a012765427680518711","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","status":"affected","lessThan":"48a5fe38772b6f039522469ee6131a67838221a8","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/group.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.169","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.135","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.82","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.23","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.13","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/group.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92"},{"url":"https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412"},{"url":"https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8"},{"url":"https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3"},{"url":"https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6"},{"url":"https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711"},{"url":"https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682"},{"url":"https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler processes TIPC GROUP_PROTOCOL messages received over configured TIPC bearers, including UDP/IP bearers that accept network packets from peer nodes. A malicious remote TIPC peer can send crafted or duplicate GRP_ACK_MSG packets to the victim group socket.\nAC:L - There is no race or hard-to-control condition; after joining or appearing as a group member, the attacker can send an ACK and then a stale or duplicate ACK with a new link sequence number. The triggering state is a normal replicast group broadcast with ACKs enabled.\nPR:N - The attacker does not need privileges on the victim system; TIPC discovery/group protocol messages are accepted from network peers after normal bearer/node establishment, with no mandatory authentication in the vulnerable path. Optional TIPC crypto or deployment filtering is not required for the vulnerable code path.\nUI:N - No victim user action is required once the vulnerable TIPC group service is running. The attacker triggers the bug by sending network protocol messages.\nS:U - The impact remains within the same kernel/TIPC communication security authority. There is no VM escape, sandbox escape, or cross-authority boundary bypass.\nC:N - The bug is a logical u16 counter underflow in group broadcast ACK accounting, not a memory disclosure or memory corruption primitive. It does not provide a way to read confidential data.\nI:N - The attacker corrupts protocol accounting state only to block later broadcasts; there is no unauthorized data modification, arbitrary write, or control-flow impact. The security consequence is denial of service rather than integrity compromise.\nA:H - Wrapping bc_ackers to 65535 makes tipc_group_bc_cong() keep reporting congestion, so subsequent group broadcasts on the affected socket remain blocked until the group is recreated. In a TIPC-based clustered or control deployment this is a persistent, remotely triggerable loss of availability for the affected communication channel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:24:12.893Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.169"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.135"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12.82"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.18.23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.19.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-31662","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:11:44.605157Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","lang":"en","type":"CWE","description":"CWE-190 Integer Overflow or Wraparound"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:56:02.280Z"}}]}}}