CVE-2026-31662 Overview
CVE-2026-31662 is an integer underflow vulnerability [CWE-191] in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in the tipc_group_proto_rcv() function, which handles group acknowledgment messages. The GRP_ACK_MSG handler decrements the bc_ackers counter on every inbound group ACK, including duplicates from members that already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK after the final legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() reports persistent congestion and blocks all subsequent group broadcasts on the affected socket until the group is recreated.
Critical Impact
Remote attackers can send duplicate GRP_ACK_MSG packets to trigger counter underflow, causing a persistent denial of service on TIPC group broadcast sockets.
Affected Products
- Linux Kernel (multiple stable branches prior to patched commits)
- Linux Kernel 4.15
- Linux Kernel 7.0 release candidates (rc1 through rc7)
Discovery Timeline
- 2026-04-24 - CVE-2026-31662 published to the National Vulnerability Database
- 2026-04-27 - Last updated in NVD database
Technical Details for CVE-2026-31662
Vulnerability Analysis
The vulnerability resides in the TIPC group protocol receive path. The tipc_group_proto_rcv() function processes GRP_ACK_MSG packets from group members acknowledging broadcast rounds. The handler unconditionally decrements bc_ackers, a u16 counter tracking outstanding acknowledgments. A duplicate or stale ACK arriving after bc_ackers reaches zero wraps the value to 65535 due to unsigned integer arithmetic.
After the underflow, the tipc_group_bc_cong() congestion check perceives 65535 pending acknowledgers and reports continuous congestion. Subsequent broadcast transmissions on the affected socket remain blocked indefinitely. Recovery requires destroying and recreating the group, making this a persistent denial-of-service condition affecting availability.
Root Cause
The root cause is missing idempotency in the GRP_ACK_MSG handler. The code modifies bc_acked and bc_ackers without first validating whether the sending member already acknowledged the current broadcast round. The patch corrects the behavior by ignoring duplicate or stale ACKs before touching either counter, preventing the underflow path.
Attack Vector
An attacker on a network reachable by a TIPC-enabled host can craft and replay GRP_ACK_MSG packets targeting an active broadcast round. No authentication or user interaction is required. Sending a duplicate ACK after the legitimate final ACK underflows bc_ackers, locking the socket's broadcast capability. The vulnerability is exploitable wherever TIPC is enabled and group communication is active, including clustered systems and orchestration frameworks that rely on TIPC for inter-node messaging.
Detection Methods for CVE-2026-31662
Indicators of Compromise
- TIPC group broadcast sockets reporting persistent congestion despite low message volume
- Applications using TIPC group communication failing to send broadcasts and only recovering after group recreation
- Unexpected GRP_ACK_MSG traffic from peers that have already acknowledged the current broadcast round
Detection Strategies
- Monitor kernel tracepoints in the TIPC subsystem for anomalous bc_ackers values, particularly values approaching u16 maximum
- Inspect TIPC bearer traffic for duplicate GRP_ACK_MSG packets originating from the same member within a single broadcast round
- Audit Linux kernel versions across the fleet against the patched commits listed in the Linux kernel stable tree
Monitoring Recommendations
- Enable network telemetry on hosts with the TIPC module loaded and alert on unexpected TIPC protocol activity
- Track availability metrics for applications dependent on TIPC group broadcasts and investigate sustained send failures
- Maintain an inventory of kernel versions and correlate against published advisory commits to identify unpatched assets
How to Mitigate CVE-2026-31662
Immediate Actions Required
- Apply the latest Linux kernel updates from your distribution vendor that incorporate the upstream TIPC fix
- Unload the TIPC kernel module on systems that do not require it using modprobe -r tipc and blacklist it in /etc/modprobe.d/
- Restrict TIPC traffic at the network layer to trusted cluster members only
Patch Information
The fix has been merged across multiple stable kernel branches. Refer to the upstream commits: 1b6f13f6, 36ec4fdd, 3bcf7aca, 48a5fe38, 575faea5, a2ea1ef0, a7db57cc, and e0bb732e. The patch makes GRP_ACK_MSG handling idempotent by ignoring duplicate or stale acknowledgments.
Workarounds
- Disable TIPC entirely where not required by adding blacklist tipc to a modprobe configuration file and rebooting
- Apply firewall rules to block external TIPC traffic (EtherType 0x88CA for native TIPC or UDP encapsulation ports) at host and network boundaries
- Restart affected applications or recreate TIPC groups as a temporary recovery step when the underflow condition is observed
# Configuration example: disable the TIPC kernel module
echo 'blacklist tipc' | sudo tee /etc/modprobe.d/disable-tipc.conf
sudo modprobe -r tipc
# Verify module is not loaded
lsmod | grep tipc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
