GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31662 (GCVE-0-2026-31662)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:45 – Updated: 2026-08-05 12:24
VLAI
Title
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < a7db57ccca21f5801609065473c89a38229ecb92 (git)
Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < 36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412 (git)
Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < 575faea557f1a184a5f09661bd47ebd3ef3769f8 (git)
Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3 (git)
Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < a2ea1ef0167d7a84730638d05c20ccdc421b14b6 (git)
Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < 1b6f13f626665cac67ba5a012765427680518711 (git)
Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682 (git)
Affected: 2f487712b89376fce267223bbb0db93d393d4b09 , < 48a5fe38772b6f039522469ee6131a67838221a8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.169 , ≤ 6.1.* (semver)
Unaffected: 6.6.135 , ≤ 6.6.* (semver)
Unaffected: 6.12.82 , ≤ 6.12.* (semver)
Unaffected: 6.18.23 , ≤ 6.18.* (semver)
Unaffected: 6.19.13 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/group.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7db57ccca21f5801609065473c89a38229ecb92",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            },
            {
              "lessThan": "36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            },
            {
              "lessThan": "575faea557f1a184a5f09661bd47ebd3ef3769f8",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            },
            {
              "lessThan": "3bcf7aca63f0bcd679ae28e9b99823c608e59ce3",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            },
            {
              "lessThan": "a2ea1ef0167d7a84730638d05c20ccdc421b14b6",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            },
            {
              "lessThan": "1b6f13f626665cac67ba5a012765427680518711",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            },
            {
              "lessThan": "e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            },
            {
              "lessThan": "48a5fe38772b6f039522469ee6131a67838221a8",
              "status": "affected",
              "version": "2f487712b89376fce267223bbb0db93d393d4b09",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/group.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable handler processes TIPC GROUP_PROTOCOL messages received over configured TIPC bearers, including UDP/IP bearers that accept network packets from peer nodes. A malicious remote TIPC peer can send crafted or duplicate GRP_ACK_MSG packets to the victim group socket.\nAC:L - There is no race or hard-to-control condition; after joining or appearing as a group member, the attacker can send an ACK and then a stale or duplicate ACK with a new link sequence number. The triggering state is a normal replicast group broadcast with ACKs enabled.\nPR:N - The attacker does not need privileges on the victim system; TIPC discovery/group protocol messages are accepted from network peers after normal bearer/node establishment, with no mandatory authentication in the vulnerable path. Optional TIPC crypto or deployment filtering is not required for the vulnerable code path.\nUI:N - No victim user action is required once the vulnerable TIPC group service is running. The attacker triggers the bug by sending network protocol messages.\nS:U - The impact remains within the same kernel/TIPC communication security authority. There is no VM escape, sandbox escape, or cross-authority boundary bypass.\nC:N - The bug is a logical u16 counter underflow in group broadcast ACK accounting, not a memory disclosure or memory corruption primitive. It does not provide a way to read confidential data.\nI:N - The attacker corrupts protocol accounting state only to block later broadcasts; there is no unauthorized data modification, arbitrary write, or control-flow impact. The security consequence is denial of service rather than integrity compromise.\nA:H - Wrapping bc_ackers to 65535 makes tipc_group_bc_cong() keep reporting congestion, so subsequent group broadcasts on the affected socket remain blocked until the group is recreated. In a TIPC-based clustered or control deployment this is a persistent, remotely triggerable loss of availability for the affected communication channel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:12.893Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92"
        },
        {
          "url": "https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412"
        },
        {
          "url": "https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8"
        }
      ],
      "title": "tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31662",
    "datePublished": "2026-04-24T14:45:12.593Z",
    "dateReserved": "2026-03-09T15:48:24.129Z",
    "dateUpdated": "2026-08-05T12:24:12.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31662",
      "date": "2026-09-16",
      "epss": "0.00389",
      "percentile": "0.32626"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-01T14:42:37.000Z",
      "cve": "CVE-2026-31662",
      "id": "msrc_CVE-2026-31662",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31662.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31662\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-24T15:16:45.820\",\"lastModified\":\"2026-06-17T10:34:11.323\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\\n\\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\\nbc_ackers on every inbound group ACK, even when the same member has\\nalready acknowledged the current broadcast round.\\n\\nBecause bc_ackers is a u16, a duplicate ACK received after the last\\nlegitimate ACK wraps the counter to 65535. Once wrapped,\\ntipc_group_bc_cong() keeps reporting congestion and later group\\nbroadcasts on the affected socket stay blocked until the group is\\nrecreated.\\n\\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\\nprevents the underflow path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/group.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"a7db57ccca21f5801609065473c89a38229ecb92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"575faea557f1a184a5f09661bd47ebd3ef3769f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"3bcf7aca63f0bcd679ae28e9b99823c608e59ce3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"a2ea1ef0167d7a84730638d05c20ccdc421b14b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"1b6f13f626665cac67ba5a012765427680518711\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f487712b89376fce267223bbb0db93d393d4b09\",\"lessThan\":\"48a5fe38772b6f039522469ee6131a67838221a8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/group.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.253\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.169\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.135\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.82\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.23\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.13\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-191\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15.1\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"B17827E3-86FD-498B-B936-E57F1C08BF4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.169\",\"matchCriteriaId\":\"DBEC0E5D-641C-4E98-A6D9-5799B10CE451\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.135\",\"matchCriteriaId\":\"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.82\",\"matchCriteriaId\":\"02904CAE-71D2-45B3-9EC3-F6A9D18B6307\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.23\",\"matchCriteriaId\":\"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.13\",\"matchCriteriaId\":\"1490EF9B-9080-481C-8D22-1306AAE664E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B4D39AF-668B-442B-8085-639A6D4FA5AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:14:58+00:00",
      "cve": "CVE-2026-31662",
      "id": "CVE-2026-31662",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31662.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T01:29:43Z",
      "cve": "CVE-2026-31662",
      "id": "CVE-2026-31662",
      "initial_release_date": "2026-04-25T01:36:42Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "449",
      "product_status:known_not_affected": "125",
      "product_status:recommended": "472",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31662",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31662.json",
      "version": "30"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.