{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74282", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.880Z", "datePublished": "2026-08-15T05:57:52.048Z", "dateUpdated": "2026-08-17T05:45:23.387Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:23.387Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent snt_unacked underflow on CONN_ACK\n\ntipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count\nfrom the unsigned 16-bit send counter snt_unacked without checking that it\ndoes not exceed the number of messages actually outstanding:\n\n\ttsk->snt_unacked -= msg_conn_ack(hdr);\n\nmsg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK\nmessage. If the ack count is larger than snt_unacked, the subtraction\nwraps to a near-maximum value, leaving tsk_conn_cong() permanently true\nand starving the connection of further transmits.\n\nValidate the ACK count at the start of the CONN_ACK block and drop the\nmessage if it acknowledges more messages than are outstanding. A peer (or,\nfor a local connection, the connected peer socket) can otherwise wedge a\nTIPC connection's send side by sending an oversized connection ack."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is reached when tipc_rcv() processes a remote CONN_MANAGER/CONN_ACK skb from a TIPC bearer (UDP port 6118 or Ethernet), traversing tipc_link_rcv()\u2192tipc_sk_rcv()\u2192tipc_sk_proto_rcv()\u2192tipc_sk_conn_proto_rcv() with attacker-controlled ack count.\nAC:L - After a normal TIPC connect handshake, the connected peer can send a single CONN_ACK whose msg_conn_ack() exceeds snt_unacked; no races, timing, or rare layout conditions are needed and the malicious field is fully attacker-controlled.\nPR:N - Exploitation only requires becoming the established TIPC peer via a standard AF_TIPC connect/listen handshake; socket creation needs no capabilities and the protocol has no authentication gate before CONN_ACK processing.\nUI:N - No victim user action is required beyond the service already accepting TIPC connections; the attacker triggers the bug by sending one crafted CONN_ACK on the established connection.\nS:U - Impact is limited to corrupting flow-control state on a victim TIPC socket within the same kernel/host security boundary; there is no VM escape, container breakout, or IOMMU boundary crossing.\nC:N - The unsigned 16-bit underflow only corrupts the snt_unacked congestion counter and does not read or disclose kernel memory, pointers, or other sensitive information.\nI:N - The bug modifies only an internal send-window counter to block transmits and provides no arbitrary write, code execution, or user/kernel data modification primitive.\nA:H - An oversized CONN_ACK wraps snt_unacked to a near-maximum value, leaving tsk_conn_cong() permanently true and indefinitely starving the victim socket's transmit path until the connection is torn down."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/socket.c"], "versions": [{"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "3388145d258cf2c4c98278e3987296007d30672e", "status": "affected", "versionType": "git"}, {"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "67e55b054bf8025658dc0e255057f2a6236416bd", "status": "affected", "versionType": "git"}, {"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "96f91b8ae1a489b3eca137e7acf42cf985fb8939", "status": "affected", "versionType": "git"}, {"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "47ed873e4ceda34098bd46d8e96b4bb13cad3a04", "status": "affected", "versionType": "git"}, {"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "b44bebdd32c9ff66ee2aebfc317ced44bedd9335", "status": "affected", "versionType": "git"}, {"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "3cfa3d8e0dc167850edeb5bf5a07757db83fd54e", "status": "affected", "versionType": "git"}, {"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "1e2c956745777e6ffdee7f30da5935741c03ee1e", "status": "affected", "versionType": "git"}, {"version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "lessThan": "ab3e10b44ba5411779aac7afd2477917dd77750f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/socket.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3388145d258cf2c4c98278e3987296007d30672e"}, {"url": "https://git.kernel.org/stable/c/67e55b054bf8025658dc0e255057f2a6236416bd"}, {"url": "https://git.kernel.org/stable/c/96f91b8ae1a489b3eca137e7acf42cf985fb8939"}, {"url": "https://git.kernel.org/stable/c/47ed873e4ceda34098bd46d8e96b4bb13cad3a04"}, {"url": "https://git.kernel.org/stable/c/b44bebdd32c9ff66ee2aebfc317ced44bedd9335"}, {"url": "https://git.kernel.org/stable/c/3cfa3d8e0dc167850edeb5bf5a07757db83fd54e"}, {"url": "https://git.kernel.org/stable/c/1e2c956745777e6ffdee7f30da5935741c03ee1e"}, {"url": "https://git.kernel.org/stable/c/ab3e10b44ba5411779aac7afd2477917dd77750f"}], "title": "tipc: prevent snt_unacked underflow on CONN_ACK", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tipc/socket.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3388145d258cf2c4c98278e3987296007d30672e", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}, {"lessThan": "67e55b054bf8025658dc0e255057f2a6236416bd", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}, {"lessThan": "96f91b8ae1a489b3eca137e7acf42cf985fb8939", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}, {"lessThan": "47ed873e4ceda34098bd46d8e96b4bb13cad3a04", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}, {"lessThan": "b44bebdd32c9ff66ee2aebfc317ced44bedd9335", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}, {"lessThan": "3cfa3d8e0dc167850edeb5bf5a07757db83fd54e", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}, {"lessThan": "1e2c956745777e6ffdee7f30da5935741c03ee1e", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}, {"lessThan": "ab3e10b44ba5411779aac7afd2477917dd77750f", "status": "affected", "version": "10724cc7bb7832b482df049c20fd824d928c5eaa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tipc/socket.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent snt_unacked underflow on CONN_ACK\n\ntipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count\nfrom the unsigned 16-bit send counter snt_unacked without checking that it\ndoes not exceed the number of messages actually outstanding:\n\n\ttsk->snt_unacked -= msg_conn_ack(hdr);\n\nmsg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK\nmessage. If the ack count is larger than snt_unacked, the subtraction\nwraps to a near-maximum value, leaving tsk_conn_cong() permanently true\nand starving the connection of further transmits.\n\nValidate the ACK count at the start of the CONN_ACK block and drop the\nmessage if it acknowledges more messages than are outstanding. A peer (or,\nfor a local connection, the connected peer socket) can otherwise wedge a\nTIPC connection's send side by sending an oversized connection ack."}], "id": "CVE-2026-74282", "lastModified": "2026-08-17T06:19:21.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:27.660", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1e2c956745777e6ffdee7f30da5935741c03ee1e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3388145d258cf2c4c98278e3987296007d30672e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3cfa3d8e0dc167850edeb5bf5a07757db83fd54e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47ed873e4ceda34098bd46d8e96b4bb13cad3a04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67e55b054bf8025658dc0e255057f2a6236416bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96f91b8ae1a489b3eca137e7acf42cf985fb8939"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab3e10b44ba5411779aac7afd2477917dd77750f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b44bebdd32c9ff66ee2aebfc317ced44bedd9335"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tipc: prevent snt_unacked underflow on CONN_ACK", "id": "2516908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516908"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntipc: prevent snt_unacked underflow on CONN_ACK\ntipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count\nfrom the unsigned 16-bit send counter snt_unacked without checking that it\ndoes not exceed the number of messages actually outstanding:\ntsk->snt_unacked -= msg_conn_ack(hdr);\nmsg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK\nmessage. If the ack count is larger than snt_unacked, the subtraction\nwraps to a near-maximum value, leaving tsk_conn_cong() permanently true\nand starving the connection of further transmits.\nValidate the ACK count at the start of the CONN_ACK block and drop the\nmessage if it acknowledges more messages than are outstanding. A peer (or,\nfor a local connection, the connected peer socket) can otherwise wedge a\nTIPC connection's send side by sending an oversized connection ack.", "A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) component. A remote or local attacker could send an oversized connection acknowledgment (ACK) message, leading to an integer underflow. This underflow can cause the connection to become permanently congested, effectively starving it of further transmissions and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-74282", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74282\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74282\nhttps://lore.kernel.org/linux-cve-announce/2026081546-CVE-2026-74282-5b9f@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,3388145d258cf2c4c98278e3987296007d30672e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,67e55b054bf8025658dc0e255057f2a6236416bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,96f91b8ae1a489b3eca137e7acf42cf985fb8939)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,47ed873e4ceda34098bd46d8e96b4bb13cad3a04)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,b44bebdd32c9ff66ee2aebfc317ced44bedd9335)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,3cfa3d8e0dc167850edeb5bf5a07757db83fd54e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,1e2c956745777e6ffdee7f30da5935741c03ee1e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10724cc7bb7832b482df049c20fd824d928c5eaa,ab3e10b44ba5411779aac7afd2477917dd77750f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:15:03.780588+00:00", "updated": "2026-08-17T15:00:08.199555+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-191"]}