CVE-2026-68289
Received Received - Intake

Integer Overflow in Linux Kernel TIPC Module

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern. Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0 Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68289
EUVD
EUVD-2026-55390

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in the Linux kernel's TIPC protocol implementation. It occurs in two functions, tipc_recvmsg() and tipc_recvstream(), where a buffer length calculation incorrectly casts a size_t value to int. When the buffer length exceeds INT_MAX, it becomes negative, causing a kernel panic due to a WARN_ON trigger in simple_copy_to_iter().

Detection Guidance

This vulnerability may trigger a kernel panic with a warning message when exploited. Check system logs for kernel panic messages or warnings related to TIPC or simple_copy_to_iter. Look for entries in /var/log/kern.log or dmesg output indicating a panic_on_warn event.

Impact Analysis

This vulnerability can cause a kernel panic, leading to system crashes and denial of service. Attackers could exploit it by sending specially crafted network packets to trigger the overflow, potentially disrupting affected systems.

Mitigation Strategies

Apply the kernel patch that changes min_t(int, ...) to min_t(size_t, ...) in tipc_recvmsg() and tipc_recvstream(). Update to a Linux kernel version containing this fix. If immediate patching is not possible, disable TIPC module loading or restrict access to TIPC sockets to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart