CVE-2026-64450: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64450 Overview

CVE-2026-64450 is an out-of-bounds read vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in the broadcast Gap ACK blocks handling path within tipc_bcast_sync_rcv(). A malicious TIPC neighbor that negotiated the TIPC_GAP_ACK_BLOCK capability can send a crafted broadcast PROTOCOL/STATE_MSG containing an attacker-controlled bgack_cnt value. The broadcast caller discards the size returned by tipc_get_gap_ack_blks(), so tipc_link_advance_transmq() copies up to 1024 bytes past the end of the socket buffer using kmemdup(). This exposes adjacent kernel slab memory contents to processing as gap/ack values.

Critical Impact
A remote TIPC neighbor can trigger a slab out-of-bounds read in the kernel with a single crafted broadcast STATE message, potentially leaking kernel memory or crashing affected hosts.

Affected Products

Linux kernel builds compiled with CONFIG_TIPC enabled
Systems where the TIPC module is loaded and TIPC bearers are configured
Distributions shipping unpatched mainline and stable kernel branches referenced in the git.kernel.org commits

Discovery Timeline

2026-07-25 - CVE-2026-64450 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64450

Vulnerability Analysis

The TIPC broadcast link processes PROTOCOL/STATE_MSG frames that may carry a Gap ACK blocks record in the message data area. The helper tipc_get_gap_ack_blks() validates only that the record's internal len field is self-consistent with its ugack_cnt and bgack_cnt counters via sz == struct_size(p, gacks, ugack_cnt + bgack_cnt). It does not verify that the declared record actually fits inside msg_data_sz().

The unicast receiver tipc_link_proto_rcv() compensates with an explicit if (glen > dlen) break; bound check. The broadcast receiver tipc_bcast_sync_rcv() discards the returned size, so downstream processing in tipc_link_advance_transmq() proceeds with an attacker-controlled count.

Root Cause

The root cause is missing bounds validation against the actual skb data area in the broadcast Gap ACK processing path [CWE-125 Out-of-Bounds Read]. When bgack_cnt is set to 0xff and len to 0x400, the internal consistency check succeeds because struct_size(p, gacks, 255) equals 0x400. kmemdup() then reads 1024 bytes from an skb whose allocated region is much smaller, as demonstrated by the KASAN report showing a read at offset 56 inside a 704-byte skbuff_small_head allocation.

Attack Vector

Exploitation requires the attacker to be a TIPC neighbor that has negotiated the TIPC_GAP_ACK_BLOCK capability. The attacker sends a single ordinary broadcast STATE message with msg_bc_ack_invalid() cleared and a short data area carrying a Gap ACK record with len = 0x400, bgack_cnt = 0xff, and ugack_cnt = 0. The kernel then executes an out-of-bounds kmemdup() covering 1024 bytes of adjacent slab memory. The copied bytes are subsequently consumed as gap and ack values, but the read itself constitutes the boundary violation regardless of downstream handling.

No exploitation code is publicly linked from the NVD advisory; the reproduction description above is taken directly from the upstream kernel commit message.

Detection Methods for CVE-2026-64450

Indicators of Compromise

KASAN slab-out-of-bounds reports in kmemdup_noprof originating from tipc_link_advance_transmq or tipc_bcast_sync_rcv in kernel logs
Unexpected TIPC neighbor sessions negotiating the TIPC_GAP_ACK_BLOCK capability from untrusted L2 segments
Kernel panics or oopses referencing tipc_link_bc_ack_rcv or tipc_rcv shortly after receipt of broadcast STATE messages

Detection Strategies

Enable KASAN on test kernels to surface any out-of-bounds reads triggered by malformed TIPC broadcasts during fuzzing or QA
Audit hosts for loaded tipc.ko and active TIPC bearers using tipc bearer list, then correlate with kernel version to identify vulnerable systems
Monitor for anomalous L2 traffic on TIPC bearer interfaces, particularly broadcast frames from unexpected MAC addresses

Monitoring Recommendations

Ship kernel ring buffer output to a central log store and alert on BUG: KASAN or tipc: warnings
Track TIPC neighbor discovery events and flag capability negotiations from hosts outside the trusted cluster inventory
Baseline the volume of TIPC STATE_MSG traffic per bearer and alert on sudden increases indicative of probing

How to Mitigate CVE-2026-64450

Immediate Actions Required

Apply the upstream fix from the referenced stable kernel commits and rebuild or update the kernel package
If patching is not immediately possible, unload the TIPC module on hosts that do not require it using rmmod tipc
Restrict TIPC bearers to trusted, isolated network segments and remove any TIPC bearer bound to untrusted L2 domains

Patch Information

The fix updates tipc_bcast_sync_rcv() to bound the Gap ACK record against msg_data_sz() and reports non-fitting records back through tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded. The corrected path preserves the legitimate ga == NULL state indicating a legacy peer without Selective ACK support. Fix commits are available at Kernel Git Commit 016f5995, Kernel Git Commit 055663d2, Kernel Git Commit 2b66974a, Kernel Git Commit 2de42e26, Kernel Git Commit 74b45af8, Kernel Git Commit 9a51115f, Kernel Git Commit a21ed506, and Kernel Git Commit f333b685.

Workarounds

Blacklist the TIPC module on hosts that do not need cluster IPC to eliminate the attack surface entirely
Enforce link-layer filtering so that only known cluster members can send frames to the TIPC bearer interface
Disable the TIPC_GAP_ACK_BLOCK code path by rejecting untrusted peers at the network layer where feasible

bash

# Prevent the TIPC module from loading until the kernel is patched
echo 'install tipc /bin/true' | sudo tee /etc/modprobe.d/disable-tipc.conf
sudo rmmod tipc 2>/dev/null || true

# Verify TIPC is no longer active
lsmod | grep -i tipc
tipc bearer list 2>&1 || echo 'TIPC not available'