CVE-2026-43411: Linux Kernel TIPC DOS Vulnerability

CVE-2026-43411 Overview

CVE-2026-43411 is a divide-by-zero flaw in the Linux kernel's Transparent Inter-Process Communication (TIPC) socket subsystem. The defect lives in tipc_sk_filter_connect() within net/tipc/socket.c. A local user can call setsockopt(TIPC_CONN_TIMEOUT) with any 32-bit value, including 0, 1, 2, or 3. When a SYN is later rejected with TIPC_ERR_OVERLOAD, the retry path computes delay %= (tsk->conn_timeout / 4). Integer division of a value below 4 yields 0, and the subsequent modulo operation triggers a divide-by-zero exception. The result is a kernel oops or panic, producing a local denial-of-service condition.

Critical Impact
An unprivileged local user can crash the kernel by setting a small TIPC_CONN_TIMEOUT value on a TIPC socket and triggering a rejected SYN.

Affected Products

Linux kernel builds that compile and load the TIPC module (CONFIG_TIPC)
Multiple stable kernel branches receiving the backported fix (see referenced commits)
Distributions shipping vulnerable Linux kernels prior to the upstream patch

Discovery Timeline

2026-05-08 - CVE-2026-43411 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43411

Vulnerability Analysis

The TIPC protocol implements a connection-oriented socket retry mechanism. When a client SYN is rejected with TIPC_ERR_OVERLOAD, the kernel attempts a randomized backoff before retrying. The backoff calculation in tipc_sk_filter_connect() uses the user-controlled conn_timeout field as the modulus divisor, dividing it by 4 first. No lower bound is enforced on the value supplied through setsockopt(TIPC_CONN_TIMEOUT). When the operand is less than 4, integer truncation produces a divisor of 0, and the % operator raises a CPU divide-error exception inside the kernel's softirq or process context. The crash trace shows the fault originating in tipc_sk_filter_rcv, propagating through tipc_sk_backlog_rcv, __release_sock, release_sock, tipc_connect, and __sys_connect. The fix clamps conn_timeout to a minimum of 4 at the point of use.

Root Cause

The root cause is missing input validation on a user-controlled socket option used as a divisor. The kernel trusts the value stored in tsk->conn_timeout without bounds checking before performing integer division and modulo arithmetic.

Attack Vector

An attacker requires only local access and the ability to create a TIPC socket. The attacker calls setsockopt(fd, SOL_TIPC, TIPC_CONN_TIMEOUT, &val, sizeof(val)) with val set to 0, 1, 2, or 3. The attacker then issues a connect() call that triggers TIPC_ERR_OVERLOAD and forces execution down the retry path, faulting the kernel.

No exploitation code is provided. Refer to the upstream commits listed under External References for the verified patch hunks, including Kernel Git Commit 2754e7b and Kernel Git Commit 338c5ed.

Detection Methods for CVE-2026-43411

Indicators of Compromise

Kernel log entries containing Oops: divide error: 0000 with RIP pointing to tipc_sk_filter_rcv or tipc_sk_filter_connect in net/tipc/socket.c.
Unexpected kernel panics or system reboots correlated with processes using TIPC sockets (address family AF_TIPC).
Audit records showing setsockopt calls against TIPC sockets with TIPC_CONN_TIMEOUT set to values below 4.

Detection Strategies

Monitor dmesg, /var/log/kern.log, and journalctl -k for divide-error oopses referencing TIPC symbols.
Use auditd rules on setsockopt syscalls to flag local processes interacting with AF_TIPC sockets in environments that do not legitimately use TIPC.
Hunt for loaded tipc modules (lsmod | grep tipc) on hosts where TIPC is not required, since unused exposure expands the local attack surface.

Monitoring Recommendations

Alert on kernel crash events and unscheduled host restarts on Linux endpoints and servers.
Track loading of the tipc kernel module via kernel module-load auditing.
Correlate process telemetry showing TIPC socket creation by non-administrative users with subsequent kernel instability.

How to Mitigate CVE-2026-43411

Immediate Actions Required

Apply the upstream Linux kernel patch or vendor-distributed update that clamps conn_timeout to a minimum of 4 in tipc_sk_filter_connect().
On systems that do not require TIPC, blacklist the tipc kernel module to remove the affected code path entirely.
Restrict creation of AF_TIPC sockets to trusted workloads using seccomp profiles or LSM policy.

Patch Information

The fix has been merged across multiple stable branches. Reference commits include Kernel Git Commit 2754e7b, Kernel Git Commit 338c5ed, Kernel Git Commit 3bc9998, Kernel Git Commit 579956f, Kernel Git Commit 600feb0, Kernel Git Commit 6c5a9ba, Kernel Git Commit a360d38, and Kernel Git Commit c2ebfbe. Pull the patch level that matches your stable branch.

Workarounds

Blacklist the TIPC module on hosts that do not need it to prevent the vulnerable code from loading.
Apply seccomp or AppArmor/SELinux policy to deny AF_TIPC socket creation by untrusted users.
Limit shell and container access on multi-tenant Linux hosts until the kernel patch is deployed.

bash

# Disable the TIPC kernel module on hosts that do not require it
echo 'install tipc /bin/true' | sudo tee /etc/modprobe.d/disable-tipc.conf
sudo rmmod tipc 2>/dev/null || true
lsmod | grep tipc   # should return no rows after reboot