Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-68289

tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern. Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0 Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e9f8b10101c6da3ab000a2fb17162374c9bd2c69 to < 9fd4f92671146b068809b6c34b50346cb30cf8f7affected
  • e9f8b10101c6da3ab000a2fb17162374c9bd2c69 to < 93580911f02d1f4a506ec0a6fc4354140c53ffe8affected
  • e9f8b10101c6da3ab000a2fb17162374c9bd2c69 to < 1b6066313b9b8fac870483bf7a26d6bd56579747affected
  • e9f8b10101c6da3ab000a2fb17162374c9bd2c69 to < 7364014fdc289225229eb08de8bcbf4580e78e4daffected
  • e9f8b10101c6da3ab000a2fb17162374c9bd2c69 to < fe9bf32bb18f2d35789d4960fb007d1059bbaa38affected
  • e9f8b10101c6da3ab000a2fb17162374c9bd2c69 to < 47f42ff521b4eeb46e82f9a46a4783a99f7570d7affected

Linux Linux

Default version status: affected

  • 4.12affected
  • 0 to < 4.12unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.1.6 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References