CVE-2026-74281

Status: UPDATED  |  Advisory ID: CVE-2026-74281

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

tipc: reject inverted service ranges from peer bindings

tipc_update_nametbl() inserts a binding advertised by a peer node using

the lower and upper service-range bounds taken directly from the wire,

without checking that lower <= upper. The local bind path validates the

ordering (tipc_uaddr_valid()), but the name-distribution path does not.

A binding with lower > upper is inserted at the far end of the

service-range rbtree (keyed on lower) where no lookup or withdrawal can

ever match it (service_range_foreach_match() requires sr->lower <= end).

The publication, its service_range node and the augmented rbtree entry

are then leaked for the lifetime of the namespace, and there is no

per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.

Reject inverted ranges in the network path as well. A peer node can

otherwise leak unbounded binding-table memory by sending PUBLICATION

items with lower > upper. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References