CVE-2026-74281 (GCVE-0-2026-74281)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
tipc: reject inverted service ranges from peer bindings
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc_update_nametbl() inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from the wire, without checking that lower <= upper. The local bind path validates the ordering (tipc_uaddr_valid()), but the name-distribution path does not. A binding with lower > upper is inserted at the far end of the service-range rbtree (keyed on lower) where no lookup or withdrawal can ever match it (service_range_foreach_match() requires sr->lower <= end). The publication, its service_range node and the augmented rbtree entry are then leaked for the lifetime of the namespace, and there is no per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings. Reject inverted ranges in the network path as well. A peer node can otherwise leak unbounded binding-table memory by sending PUBLICATION items with lower > upper.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 37922ea4a3105176357c8d565a9d982c4a08714a , < cd1955f81bd8ebeef51b324989ac871ad1947fb6 (git)
Affected: 37922ea4a3105176357c8d565a9d982c4a08714a , < f683200b83a0085d4e11abea8c1fdd9fdfb95b0b (git)
Affected: 37922ea4a3105176357c8d565a9d982c4a08714a , < f1715d92ee3095d9215b493a8603a81f646fcf61 (git)
Affected: 37922ea4a3105176357c8d565a9d982c4a08714a , < 581ef56e5c34d475056ce086dc2ba0e872ba6857 (git)
Affected: 37922ea4a3105176357c8d565a9d982c4a08714a , < 7e401233f9bb74a626e70698d0d62f3a94ac0676 (git)
Affected: 37922ea4a3105176357c8d565a9d982c4a08714a , < 973bf0ed896b9898668dbadb82ed849d7d573010 (git)
Affected: 37922ea4a3105176357c8d565a9d982c4a08714a , < 2afb648f7b99216c687db1f89739c995e1144153 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/name_distr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd1955f81bd8ebeef51b324989ac871ad1947fb6",
              "status": "affected",
              "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
              "versionType": "git"
            },
            {
              "lessThan": "f683200b83a0085d4e11abea8c1fdd9fdfb95b0b",
              "status": "affected",
              "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
              "versionType": "git"
            },
            {
              "lessThan": "f1715d92ee3095d9215b493a8603a81f646fcf61",
              "status": "affected",
              "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
              "versionType": "git"
            },
            {
              "lessThan": "581ef56e5c34d475056ce086dc2ba0e872ba6857",
              "status": "affected",
              "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
              "versionType": "git"
            },
            {
              "lessThan": "7e401233f9bb74a626e70698d0d62f3a94ac0676",
              "status": "affected",
              "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
              "versionType": "git"
            },
            {
              "lessThan": "973bf0ed896b9898668dbadb82ed849d7d573010",
              "status": "affected",
              "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
              "versionType": "git"
            },
            {
              "lessThan": "2afb648f7b99216c687db1f89739c995e1144153",
              "status": "affected",
              "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/name_distr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject inverted service ranges from peer bindings\n\ntipc_update_nametbl() inserts a binding advertised by a peer node using\nthe lower and upper service-range bounds taken directly from the wire,\nwithout checking that lower \u003c= upper. The local bind path validates the\nordering (tipc_uaddr_valid()), but the name-distribution path does not.\n\nA binding with lower \u003e upper is inserted at the far end of the\nservice-range rbtree (keyed on lower) where no lookup or withdrawal can\never match it (service_range_foreach_match() requires sr-\u003elower \u003c= end).\nThe publication, its service_range node and the augmented rbtree entry\nare then leaked for the lifetime of the namespace, and there is no\nper-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.\n\nReject inverted ranges in the network path as well. A peer node can\notherwise leak unbounded binding-table memory by sending PUBLICATION\nitems with lower \u003e upper."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - NAME_DISTRIBUTOR PUBLICATION messages from a remote TIPC peer are processed via tipc_rcv/tipc_link_rcv into tipc_named_rcv with no local syscall, matching Network attack vector for in-kernel protocol handlers.\nAC:L - Sending PUBLICATION items with lower\u003eupper reliably triggers permanent leaked binding-table entries; attacker controls both ends of the exchange over an established link with no race or victim-dependent timing.\nPR:N - A malicious or compromised cluster peer can send crafted name-table updates without any account or capability on the victim; TIPC accepts peer publications after normal link setup without per-message authentication by default.\nUI:N - Victim nodes ingest peer binding advertisements automatically during TIPC name distribution; no administrator or user action is required beyond routine cluster connectivity.\nS:U - The flaw only causes unreachable kernel heap growth in the victim\u0027s network namespace and does not cross VM, container, or IOMMU security boundaries.\nC:N - The issue is allocation without corresponding free of publication/service_range objects; it does not read or disclose kernel or user data beyond attacker-chosen binding fields.\nI:N - Inverted ranges create orphaned nametable metadata without corrupting adjacent memory or modifying legitimate bindings, sockets, or user data.\nA:H - Each unique inverted publication permanently leaks publication, service_range, and rbtree nodes with no per-peer cap and failed cleanup on peer loss/withdrawal, enabling repeatable remote kernel memory exhaustion and OOM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:22.291Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61"
        },
        {
          "url": "https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676"
        },
        {
          "url": "https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010"
        },
        {
          "url": "https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153"
        }
      ],
      "title": "tipc: reject inverted service ranges from peer bindings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74281",
    "datePublished": "2026-08-15T05:57:51.423Z",
    "dateReserved": "2026-08-15T05:44:03.880Z",
    "dateUpdated": "2026-08-17T05:45:22.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74281",
      "date": "2026-09-21",
      "epss": "0.00662",
      "percentile": "0.49859"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/name_distr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cd1955f81bd8ebeef51b324989ac871ad1947fb6",
                    "status": "affected",
                    "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f683200b83a0085d4e11abea8c1fdd9fdfb95b0b",
                    "status": "affected",
                    "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1715d92ee3095d9215b493a8603a81f646fcf61",
                    "status": "affected",
                    "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "581ef56e5c34d475056ce086dc2ba0e872ba6857",
                    "status": "affected",
                    "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7e401233f9bb74a626e70698d0d62f3a94ac0676",
                    "status": "affected",
                    "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "973bf0ed896b9898668dbadb82ed849d7d573010",
                    "status": "affected",
                    "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2afb648f7b99216c687db1f89739c995e1144153",
                    "status": "affected",
                    "version": "37922ea4a3105176357c8d565a9d982c4a08714a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/tipc/name_distr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject inverted service ranges from peer bindings\n\ntipc_update_nametbl() inserts a binding advertised by a peer node using\nthe lower and upper service-range bounds taken directly from the wire,\nwithout checking that lower \u003c= upper. The local bind path validates the\nordering (tipc_uaddr_valid()), but the name-distribution path does not.\n\nA binding with lower \u003e upper is inserted at the far end of the\nservice-range rbtree (keyed on lower) where no lookup or withdrawal can\never match it (service_range_foreach_match() requires sr-\u003elower \u003c= end).\nThe publication, its service_range node and the augmented rbtree entry\nare then leaked for the lifetime of the namespace, and there is no\nper-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.\n\nReject inverted ranges in the network path as well. A peer node can\notherwise leak unbounded binding-table memory by sending PUBLICATION\nitems with lower \u003e upper."
          }
        ],
        "id": "CVE-2026-74281",
        "lastModified": "2026-08-17T06:19:21.863",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:27.547",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T12:44:28+00:00",
      "cve": "CVE-2026-74281",
      "id": "CVE-2026-74281",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: reject inverted service ranges from peer bindings",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74281.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:23:35Z",
      "cve": "CVE-2026-74281",
      "id": "CVE-2026-74281",
      "initial_release_date": "2026-08-26T01:13:56Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74281",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74281.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.