CVE-2026-98550

A flaw was found in the TIPC (Transparent Inter-Process Communication) subsystem of the Linux kernel. This flaw allows an attacker to cause a Denial of Service (DoS) by sending unexpected or duplicate group acknowledgment messages. Due to improper validation of incoming protocol messages, an internal acknowledgment counter can underflow, permanently placing the socket into a congested state and blocking all subsequent broadcast communication.

TIPC group ACK processing accepts invalid or unexpected GRP_ACK_MSG values that do not correspond to the current broadcast round. An ACK received when bc_ackers is zero can underflow the u16 counter to 65535, while an incorrect sequence during an active round can decrement the counter more than once for the same member. This can make tipc_group_bc_cong permanently report congestion and block future group broadcasts on the affected socket. For the CVSS the PR:N value is used because no privileges on the target are required when an attacker can transmit crafted TIPC messages as a recognized group member. The attack is network adjacent rather than generally Internet reachable because it requires access to the TIPC bearer or cluster network. The demonstrated impact is availability loss for the affected group socket, with no supported UAF, OOB access, information disclosure, or privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce strict sequence verification and reject unexpected GRP_ACK_MSG messages in the TIPC kernel subsystem before decrementing bc_ackers: upgrade to the fixed Kernel/Kernel Ivos Qualcomm/Kernel Rt/Openshift/Ose Rhel Coreos/Kpatch builds, which drop GRP_ACK_MSG immediately if grp->bc_ackers is zero, require acked to strictly equal grp->bc_snd_nxt, and reject duplicate acknowledgments, closing all 2 injection vectors (unexpected GRP_ACK_MSG when bc_ackers is zero, stale sequence ACK injection exploiting the sequence gap in active broadcast rounds). Until patched, this is only a concern on Linux systems running the TIPC kernel module with active or listening group communication sockets — Non-Linux platforms are unaffected — so Restrict network connectivity capable of delivering TIPC traffic to target nodes and avoid loading the TIPC kernel module where group sockets are not needed. As a compensating measure, Enable compiler integer overflow and conversion checks or UBSan integer sanitization to trap runtime unsigned integer underflows when bc_ackers is decremented below zero. These controls limit blast radius and contain exploitation, but they do not fix the underlying TIPC acknowledgment integer underflow defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (medium)