CVE-2026-31662: Linux Kernel DoS Vulnerability

CVE-2026-31662 Overview

CVE-2026-31662 is an Integer Underflow vulnerability discovered in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw exists in the tipc_group_proto_rcv() function, which handles GRP_ACK_MSG protocol messages. When processing duplicate group acknowledgment messages, the handler incorrectly decrements the bc_ackers counter without validating whether the message has already been processed, leading to an integer underflow condition.

Critical Impact

Successful exploitation causes the bc_ackers counter (a u16 type) to wrap from 0 to 65535, resulting in persistent denial of service where all subsequent group broadcasts on the affected socket remain blocked until the group is recreated.

Affected Products

• Linux Kernel versions from 4.15 onwards
• Linux Kernel 7.0 release candidates (rc1 through rc7)
• Systems using TIPC group communication functionality

Discovery Timeline

• April 24, 2026 - CVE-2026-31662 published to NVD
• April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31662

Vulnerability Analysis

The vulnerability resides in the TIPC group communication protocol handler within the Linux kernel. The tipc_group_proto_rcv() function processes incoming GRP_ACK_MSG messages, which are acknowledgments from group members confirming receipt of broadcast messages. The function maintains a bc_ackers counter to track how many members still need to acknowledge the current broadcast round.

The fundamental issue is that the handler decrements bc_ackers on every inbound group ACK without checking whether the specific member has already acknowledged the current broadcast round. In normal operation, each member sends exactly one ACK per broadcast round, and bc_ackers decrements from the total member count down to zero.

However, when duplicate or replayed ACK messages arrive (due to network conditions, malicious crafting, or protocol anomalies), the counter continues decrementing past zero. Since bc_ackers is declared as a u16 (unsigned 16-bit integer), decrementing when the value is already zero causes the counter to wrap around to 65535.

Root Cause

The root cause is the absence of idempotent handling for GRP_ACK_MSG messages in tipc_group_proto_rcv(). The code lacks validation to track which members have already acknowledged and should filter out duplicate or stale ACKs before modifying the bc_acked or bc_ackers state variables.

This is classified as CWE-191 (Integer Underflow), where an arithmetic operation produces a result below the minimum value representable by the data type, causing the value to wrap to a large positive number.

Attack Vector

An attacker with network access can exploit this vulnerability by sending crafted duplicate GRP_ACK_MSG packets to a TIPC socket participating in group communication. The attack does not require authentication or user interaction.

Once the underflow occurs, tipc_group_bc_cong() interprets the large bc_ackers value (65535) as indicating severe congestion, causing it to report that the group is congested. This blocks all subsequent broadcast operations on the affected socket. The denial of service persists until the application destroys and recreates the TIPC group, as no self-healing mechanism exists to detect or correct the corrupted counter state.

The vulnerability affects systems where TIPC is enabled and used for inter-process or inter-node communication, commonly found in cluster computing environments, high-availability systems, and distributed applications.

Detection Methods for CVE-2026-31662

Indicators of Compromise

• Sudden persistent failures of TIPC group broadcast operations returning congestion errors
• The bc_ackers counter showing an abnormally high value (near 65535) when it should be at or near zero
• Applications using TIPC group communication experiencing unexplained hangs on broadcast calls

Detection Strategies

• Monitor TIPC socket statistics for anomalous bc_ackers values using kernel tracing or debugging interfaces
• Deploy network traffic analysis to detect duplicate or replayed GRP_ACK_MSG packets targeting TIPC ports
• Configure SentinelOne's Singularity Platform to alert on kernel module behavior anomalies related to TIPC subsystem state

Monitoring Recommendations

• Enable kernel auditing for TIPC protocol message handling events
• Implement network-level monitoring for unusual TIPC message patterns or replay attacks
• Use SentinelOne endpoint detection to identify processes experiencing repeated TIPC broadcast failures

How to Mitigate CVE-2026-31662

Immediate Actions Required

• Apply the official kernel patch from the Linux kernel stable branches immediately
• If patching is not immediately possible, consider temporarily disabling TIPC if it is not essential to operations
• Monitor affected systems for signs of exploitation while awaiting patch deployment

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches to address this vulnerability. The fix implements idempotent handling for GRP_ACK_MSG by ignoring duplicate or stale ACKs before modifying the bc_acked or bc_ackers counters.

Official patches are available through the following kernel commits:

• Linux Kernel Commit 1b6f13f
• Linux Kernel Commit 36ec4fd
• Linux Kernel Commit 3bcf7ac
• Linux Kernel Commit 48a5fea
• Linux Kernel Commit 575faea
• Linux Kernel Commit a2ea1ef
• Linux Kernel Commit a7db57c
• Linux Kernel Commit e0bb732

Workarounds

• Disable TIPC kernel module if group communication functionality is not required using modprobe -r tipc
• Implement network-level filtering to prevent untrusted sources from sending TIPC protocol messages
• Isolate TIPC-enabled systems in restricted network segments to limit exposure to potential attackers

# Disable TIPC module if not required
sudo modprobe -r tipc

# Prevent TIPC module from loading on boot
echo "blacklist tipc" | sudo tee /etc/modprobe.d/blacklist-tipc.conf

# Verify TIPC module is not loaded
lsmod | grep tipc