Look up another CVE · open CVE-2026-74281 in the interactive tracker

CVE-2026-74281

tipc: reject inverted service ranges from peer bindings

7.5 EPSS 0.7% AV:N

Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/tipc. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-74281 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixed	6.1.180-1	Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.100-1	Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

tipc_update_nametbl() inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower <= upper. The local bind path validates the ordering (tipc_uaddr_valid()), but the name-distribution path does not. A binding with lower > upper is inserted at the far end of the service-range rbtree (keyed on lower) where no lookup or withdrawal can ever match it (service_range_foreach_match() requires sr->lower <= end). The publication, its service_range node and the augmented rbtree entry are then leaked for the lifetime of the namespace, and there is no per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings. Reject inverted ranges in the network path as well. A peer node can otherwise leak unbounded binding-table memory by sending PUBLICATION items with lower > upper.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/tipc/name_distr.c

What this is: TIPC NETWORK LAYERMAINTAINERS section matched on net/tipc/ · netdev@vger.kernel.org · Maintained
Kernel module: tipc

Check it on the machine

grep -w CONFIG_TIPC /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w tipc

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_TIPC

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-15 (2 months ago)source
CVSS: 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.68%, higher than 51.4% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/tipc

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.17	5.15.212	cd1955f81bd8
4.17	6.1.178	f683200b83a0
4.17	6.6.145	f1715d92ee30
4.17	6.12.97	581ef56e5c34
4.17	6.18.40	7e401233f9bb
4.17	7.1.5	973bf0ed896b
4.17	7.2	2afb648f7b99

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: NAME_DISTRIBUTOR PUBLICATION messages from a remote TIPC peer are processed via tipc_rcv/tipc_link_rcv into tipc_named_rcv with no local syscall, matching Network attack vector for in-kernel protocol handlers.
AC:LAttack complexity, low: Sending PUBLICATION items with lower>upper reliably triggers permanent leaked binding-table entries; attacker controls both ends of the exchange over an established link with no race or victim-dependent timing.
PR:NPrivileges required, none: A malicious or compromised cluster peer can send crafted name-table updates without any account or capability on the victim; TIPC accepts peer publications after normal link setup without per-message authentication by default.
UI:NUser interaction, none: Victim nodes ingest peer binding advertisements automatically during TIPC name distribution; no administrator or user action is required beyond routine cluster connectivity.
S:UScope, unchanged: The flaw only causes unreachable kernel heap growth in the victim's network namespace and does not cross VM, container, or IOMMU security boundaries.
C:NConfidentiality impact, none: The issue is allocation without corresponding free of publication/service_range objects; it does not read or disclose kernel or user data beyond attacker-chosen binding fields.
I:NIntegrity impact, none: Inverted ranges create orphaned nametable metadata without corrupting adjacent memory or modifying legitimate bindings, sockets, or user data.
A:HAvailability impact, high: Each unique inverted publication permanently leaks publication, service_range, and rbtree nodes with no per-peer cap and failed cleanup on peer loss/withdrawal, enabling repeatable remote kernel memory exhaustion and OOM.