Look up another CVE · open CVE-2026-64450 in the interactive tracker
CVE-2026-64450
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem net/tipc. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64450 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.96-1 | Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check that the record actually fits in the message data area, msg_data_sz(). The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen) break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the returned size, so tipc_link_advance_transmq() copies the record off the receive skb with an attacker-controlled count: this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt), GFP_ATOMIC); A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its data area is short, carrying a Gap ACK record with len = 0x400, bgack_cnt = 0xff and ugack_cnt = 0. len then equals struct_size(p, gacks, 255), so the consistency check passes and ga is non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out of the much smaller skb: BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60 Read of size 1024 at addr ffff0000c7030d38 by task poc864/69 Call trace: kmemdup_noprof+0x48/0x60 tipc_link_advance_transmq+0x86c/0xb80 tipc_link_bc_ack_rcv+0x19c/0x1e0 tipc_bcast_sync_rcv+0x1c4/0x2c4 tipc_rcv+0x85c/0x1340 tipc_l2_rcv_msg+0xac/0x104 The buggy address belongs to the object at ffff0000c7030d00 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 56 bytes inside of allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0) The copied-out bytes are subsequently consumed as gap/ack values, but the read is already out of bounds at the kmemdup() regardless of how they are used. The unicast STATE path drops such a message: "if (glen > dlen) break;" skips the rest of STATE_MSG handling and the skb is freed. Make the broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record against msg_data_sz() and, when it does not fit, reports it back through tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than processed. ga is not cleared on this path: ga == NULL already means "legacy peer without Selective ACK", a distinct legitimate state.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/tipc/bcast.c
net/tipc/bcast.h
net/tipc/node.c
- What this is
- TIPC NETWORK LAYERMAINTAINERS section matched on net/tipc/ · netdev@vger.kernel.org · Maintained
- Kernel module
- tipc
Check it on the machine
grep -w CONFIG_TIPC /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w tipcPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_TIPC
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-25 (3 months ago)source
- CVSS
- 9.1 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.54%, higher than 44.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/tipc
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.8 | 5.10.261 | 055663d21dc4 |
| 5.8 | 5.15.212 | 016f5995c37a |
| 5.8 | 6.1.178 | 74b45af86a76 |
| 5.8 | 6.6.145 | 9a51115fcdc7 |
| 5.8 | 6.12.96 | a21ed5064217 |
| 5.8 | 6.18.39 | 2de42e268174 |
| 5.8 | 7.1.4 | f333b6851bdf |
| 5.8 | 7.2 | 2b66974a1b61 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.
- AC:LAttack complexity, low
- The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.
- PR:NPrivileges required, none
- The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.
- UI:NUser interaction, none
- No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.
- S:UScope, unchanged
- The vulnerability compromises availability and potentially confidentiality within the receiving kernel's existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.
- C:HConfidentiality impact, high
- The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.
- I:NIntegrity impact, none
- The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.
- A:HAvailability impact, high
- The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly.