Cloudanix VulnDB

CVE-2026-68297

None

CVSS

—

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel networking code lets an ordinary user send bad settings that can crash the whole system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

User-supplied MTU values exceeding U16_MAX bypass minimum-only validation in TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET, undergo silent truncation to u16 fields, and trigger division-by-zero in tipc_link_set_queue_limits or produce invalid link MTUs leading to malfunction.

Why it matters to the business

Unprivileged local users can trigger kernel crashes or unstable TIPC links, causing denial of service on affected systems and potential disruption of cluster or high-availability workloads that rely on TIPC.

How an attack unfolds

An attacker in a user namespace invokes TIPC netlink commands to set an MTU larger than 65535; the value passes the incomplete checks in tipc_udp_mtu_bad or the bearer set path, is truncated inside tipc_link_create, and later causes a divide-by-zero or malformed link state when discovery or UDP receive paths activate the link.

How to fix it

Apply the upstream fix that adds an explicit upper-bound rejection of MTU values greater than U16_MAX in both tipc_udp_mtu_bad and the inline check inside __tipc_nl_bearer_set; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the patched kernel source contains the added > U16_MAX rejection; attempt to set an MTU of 65536 via netlink and verify the operation is now rejected with an error rather than accepted.

Typical attack path

  1. Obtain unprivileged access inside a user namespace
  2. Issue TIPC_NL_MEDIA_SET or TIPC_NL_BEARER_SET netlink message with MTU > U16_MAX
  3. Trigger TIPC discovery or UDP receive path that calls tipc_link_create
  4. Execute tipc_link_set_queue_limits resulting in division by zero or invalid MTU
  5. Kernel panic or link malfunction occurs

How to detect it

Search kernel logs and crash dumps for stack traces that include tipc_link_set_queue_limits, tipc_link_create, tipc_node_check_dest, tipc_disc_rcv, and tipc_udp_recv; correlate with netlink activity setting TIPC media or bearer MTU values.

  • tipc_link_set_queue_limits
  • tipc_link_create
  • TIPC_NL_MEDIA_SET
  • TIPC_NL_BEARER_SET
  • division by zero in tipc

What your security team should do

  • Prioritize patching Linux kernels that include TIPC and expose netlink interfaces to untrusted namespaces
  • Restrict TIPC netlink operations to privileged users via SELinux or AppArmor until patches are applied
  • Monitor for kernel oops containing tipc_link_set_queue_limits and tipc_link_create

The record

In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is silently truncated when assigned to u16 fields l->mtu and l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000) truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values (e.g. 65537-131071) produce small incorrect MTU values, resulting in link malfunction behaviors. Crash stack (triggered as unprivileged user via user namespace): tipc_link_set_queue_limits net/tipc/link.c:2531 tipc_link_create net/tipc/link.c:520 tipc_node_check_dest net/tipc/node.c:1279 tipc_disc_rcv net/tipc/discover.c:252 tipc_rcv net/tipc/node.c:2129 tipc_udp_recv net/tipc/udp_media.c:392 Two independent paths lack the upper bound check: 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET) 2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET) Fix both by rejecting MTU values above U16_MAX.

Affected packages

Ecosystem Package Introduced Fixed