CVE-2026-68297
Received Received - Intake

Integer Overflow in Linux Kernel TIPC MTU Validation

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is silently truncated when assigned to u16 fields l->mtu and l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000) truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values (e.g. 65537-131071) produce small incorrect MTU values, resulting in link malfunction behaviors. Crash stack (triggered as unprivileged user via user namespace): tipc_link_set_queue_limits net/tipc/link.c:2531 tipc_link_create net/tipc/link.c:520 tipc_node_check_dest net/tipc/node.c:1279 tipc_disc_rcv net/tipc/discover.c:252 tipc_rcv net/tipc/node.c:2129 tipc_udp_recv net/tipc/udp_media.c:392 Two independent paths lack the upper bound check: 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET) 2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET) Fix both by rejecting MTU values above U16_MAX.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68297
EUVD
EUVD-2026-55398

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of MTU (Maximum Transmission Unit) values in the TIPC (Transparent Inter-Process Communication) protocol. When a user sets an MTU value exceeding 65535 (U16_MAX), it gets truncated to an incorrect value, leading to a division by zero or link malfunction.

Detection Guidance

This vulnerability can be detected by checking for MTU values exceeding 65535 in TIPC media or bearer configurations. Inspect kernel logs for division by zero errors or link malfunctions in TIPC. Use commands like 'dmesg | grep -i tipc' or 'journalctl -k | grep -i tipc' to search for related errors.

Impact Analysis

An attacker could exploit this to crash the system by causing a division by zero, leading to a denial of service. It may also disrupt network communication by causing incorrect MTU values, affecting data transmission.

Mitigation Strategies

Apply the latest Linux kernel security patches to fix the MTU validation issue. Ensure TIPC media and bearer MTU values do not exceed 65535. Monitor network links for abnormal behavior and update TIPC module if running an affected version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68297. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart