CVE-2026-31662

tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

State: Published
Severity: 7.5 High
Published: Apr 24, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round.

Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated.

Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	2f487712b89376fce267223bbb0db93d393d4b09 to before a7db57ccca21f5801609065473c89a38229ecb92Affected 2f487712b89376fce267223bbb0db93d393d4b09 to before 36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412Affected 2f487712b89376fce267223bbb0db93d393d4b09 to before 575faea557f1a184a5f09661bd47ebd3ef3769f8Affected 2f487712b89376fce267223bbb0db93d393d4b09 to before 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3Affected 2f487712b89376fce267223bbb0db93d393d4b09 to before a2ea1ef0167d7a84730638d05c20ccdc421b14b6Affected 2f487712b89376fce267223bbb0db93d393d4b09 to before 1b6f13f626665cac67ba5a012765427680518711Affected 2f487712b89376fce267223bbb0db93d393d4b09 to before e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682Affected 2f487712b89376fce267223bbb0db93d393d4b09 to before 48a5fe38772b6f039522469ee6131a67838221a8Affected
LinuxLinux	4.15Affected before 4.15Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.169 through 6.1.Not affected 6.6.135 through 6.6.Not affected 6.12.82 through 6.12.Not affected 6.18.23 through 6.18.Not affected 6.19.13 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

2f487712b89376fce267223bbb0db93d393d4b09 to before a7db57ccca21f5801609065473c89a38229ecb92Affected
2f487712b89376fce267223bbb0db93d393d4b09 to before 36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412Affected
2f487712b89376fce267223bbb0db93d393d4b09 to before 575faea557f1a184a5f09661bd47ebd3ef3769f8Affected
2f487712b89376fce267223bbb0db93d393d4b09 to before 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3Affected
2f487712b89376fce267223bbb0db93d393d4b09 to before a2ea1ef0167d7a84730638d05c20ccdc421b14b6Affected
2f487712b89376fce267223bbb0db93d393d4b09 to before 1b6f13f626665cac67ba5a012765427680518711Affected
2f487712b89376fce267223bbb0db93d393d4b09 to before e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682Affected
2f487712b89376fce267223bbb0db93d393d4b09 to before 48a5fe38772b6f039522469ee6131a67838221a8Affected

LinuxLinux

4.15Affected
before 4.15Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.169 through 6.1.*Not affected
6.6.135 through 6.6.*Not affected
6.12.82 through 6.12.*Not affected
6.18.23 through 6.18.*Not affected
6.19.13 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.