CVE-2026-74281

A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) module. A remote attacker, acting as a peer node, could exploit this by sending specially crafted PUBLICATION messages with inverted service ranges. This oversight in validating service range bounds allows the attacker to cause unbounded memory leaks in the binding table, leading to a denial of service (DoS) for the affected system.

A moderate severity flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) module. When processing name-distribution messages from peer nodes, tipc_update_nametbl() inserts an advertised binding using the lower and upper service-range bounds taken directly from the wire without validating that the lower bound is not greater than the upper bound. A remote attacker acting as a TIPC peer node could send specially crafted PUBLICATION messages with inverted service ranges (lower > upper); such bindings are stored at the far end of the service-range tree where no lookup or withdrawal can ever match them, so the publication, its service-range node, and the augmented rbtree entry are leaked for the lifetime of the namespace, with no per-peer cap on remotely advertised bindings. Repeated malicious publications could therefore exhaust kernel memory and cause a denial of service. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams, the fix is currently deferred given the Moderate impact rating and the fact that exploitation requires the attacker to act as a reachable peer node within a TIPC cluster network; the residual risk is denial of service through unbounded binding-table memory growth on systems that participate in a TIPC network with untrusted peers. Red Hat rates this flaw Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) while the upstream CVE record scores it 7.5 Important (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); the difference reflects Red Hat's assessment that exploitation requires an attacker to be a reachable peer in a TIPC network rather than an arbitrary network-facing service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.