CVE-2026-68297

Received Received - Intake

Integer Overflow in Linux Kernel TIPC MTU Validation

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is silently truncated when assigned to u16 fields l->mtu and l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000) truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values (e.g. 65537-131071) produce small incorrect MTU values, resulting in link malfunction behaviors. Crash stack (triggered as unprivileged user via user namespace): tipc_link_set_queue_limits net/tipc/link.c:2531 tipc_link_create net/tipc/link.c:520 tipc_node_check_dest net/tipc/node.c:1279 tipc_disc_rcv net/tipc/discover.c:252 tipc_rcv net/tipc/node.c:2129 tipc_udp_recv net/tipc/udp_media.c:392 Two independent paths lack the upper bound check: 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET) 2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET) Fix both by rejecting MTU values above U16_MAX.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68297

EUVD

EUVD-2026-55398

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of MTU (Maximum Transmission Unit) values in the TIPC (Transparent Inter-Process Communication) protocol. When a user sets an MTU value exceeding 65535 (U16_MAX), it gets truncated to an incorrect value, leading to a division by zero or link malfunction.

Detection Guidance

This vulnerability can be detected by checking for MTU values exceeding 65535 in TIPC media or bearer configurations. Inspect kernel logs for division by zero errors or link malfunctions in TIPC. Use commands like 'dmesg | grep -i tipc' or 'journalctl -k | grep -i tipc' to search for related errors.

Impact Analysis

An attacker could exploit this to crash the system by causing a division by zero, leading to a denial of service. It may also disrupt network communication by causing incorrect MTU values, affecting data transmission.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a Linux kernel network protocol (TIPC) issue. The impact is limited to potential denial-of-service conditions due to MTU truncation leading to division by zero or incorrect MTU values. No data confidentiality or integrity violations are described.

Mitigation Strategies

Apply the latest Linux kernel security patches to fix the MTU validation issue. Ensure TIPC media and bearer MTU values do not exceed 65535. Monitor network links for abnormal behavior and update TIPC module if running an affected version.

Hi! I’m here to help you understand CVE-2026-68297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...