CVE-2026-74281

Received Received - Intake

TIPC Service Range Inversion Memory Leak

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc_update_nametbl() inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower <= upper. The local bind path validates the ordering (tipc_uaddr_valid()), but the name-distribution path does not. A binding with lower > upper is inserted at the far end of the service-range rbtree (keyed on lower) where no lookup or withdrawal can ever match it (service_range_foreach_match() requires sr->lower <= end). The publication, its service_range node and the augmented rbtree entry are then leaked for the lifetime of the namespace, and there is no per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings. Reject inverted ranges in the network path as well. A peer node can otherwise leak unbounded binding-table memory by sending PUBLICATION items with lower > upper.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74281

EUVD

EUVD-2026-59428

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the TIPC (Transparent Inter-Process Communication) protocol. A peer node can send a binding with inverted service ranges where the lower bound is greater than the upper bound. The kernel fails to validate this ordering during network path processing, leading to memory leaks and unbounded resource consumption in the binding table.

Detection Guidance

This vulnerability involves inverted service ranges in TIPC bindings. Detection requires checking for malformed TIPC service range publications in kernel logs or network traffic. Use commands like 'dmesg | grep tipc' or 'journalctl -k | grep tipc' to inspect kernel logs for TIPC-related errors. Monitor memory usage with 'cat /proc/meminfo' for unusual growth. If TIPC is enabled, inspect bindings with 'tipc link list' and 'tipc bearer list' for anomalies.

Impact Analysis

An attacker on the same network could exploit this to cause a denial of service by consuming excessive memory on the affected system. This could lead to system slowdowns or crashes due to resource exhaustion in the TIPC service.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory leak in the Linux kernel's TIPC protocol due to improper validation of service-range bounds. Compliance impacts would depend on system configuration and data processing activities, not the vulnerability itself.

Mitigation Strategies

Immediately update the Linux kernel to the patched version. Disable TIPC if not required using 'modprobe -r tipc' or by blacklisting the module. Restrict network access to TIPC ports (default 650) via firewall rules. Monitor memory usage and kernel logs for signs of exploitation. If TIPC is essential, apply vendor patches promptly.

Hi! I’m here to help you understand CVE-2026-74281. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70