CVE-2026-64450

A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) module. A remote TIPC neighbor can send a specially crafted broadcast message containing a malformed Gap ACK blocks record. This vulnerability occurs because the system fails to properly validate the record's length, leading to an out-of-bounds read during memory processing. This can result in information disclosure or a denial of service.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because the TIPC protocol is not loaded or configured by default on standard installations. While an adjacent network peer in a cluster could trigger a kernel crash or disclose memory through malformed broadcast state traffic, exploitation is constrained to hosts actively utilizing TIPC communication. Environments that do not load the tipc module or do not interface with untrusted cluster nodes remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.