CVE-2026-64450 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who rely on the TIPC module should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing and applying patches, restricting access to the TIPC module, and monitoring network traffic for suspicious activity. Additionally, security teams and vulnerability management teams should be aware of the potential impact of this vulnerability on their systems and take steps  

Why it matters

CVE-2026-64450 is a critical vulnerability in the Linux kernel's TIPC module that can lead to a denial-of-service (DoS) or potentially allow for code execution. Linux kernel developers, administrators, and users who rely on the TIPC module should be aware of this vulnerability and take necessary actions to mitigate it.

• Denial-of-service (DoS) due to out-of-bounds read
• Potential code execution with specially crafted input
• Increased risk for TIPC module users due to lack of input validation

Technical summary

The Linux kernel's TIPC module is vulnerable to an out-of-bounds read in broadcast Gap ACK blocks. The issue arises from the tipc_get_gap_ack_blks() function not verifying that the Gap ACK blocks record fits within the message data area. This can lead to an out-of-bounds read when the record is copied. The vulnerability can be triggered by a TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK with a specially crafted broadcast STATE_MSG. The vulnerability has a CVSS score of 9.1 and is considered critical. Linux kernel developers, administrators, and users who rely on the TIPC module should be aware of this vulnerability and take necessary actions to mitigate it.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches from the Linux kernel repository.
• Restrict access to the TIPC module to only trusted sources.
• Monitor network traffic for suspicious activity.
• Implement additional security measures such as intrusion detection and prevention systems.
• Conduct a thorough review of the system's exposure to the vulnerability.
• Develop and implement a plan to remediate the vulnerability.
• Verify that the patches have been successfully applied and that the system is no longer vulnerable.

Evidence notes

The vulnerability was introduced in the Linux kernel's TIPC module. The issue arises from the tipc_get_gap_ack_blks() function not verifying that the Gap ACK blocks record fits within the message data area. This can lead to an out-of-bounds read when the record is copied. The vulnerability can be triggered by a TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK with a specially crafted broadcast STATE_MSG.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.