CVE-2026-68289: Linux Kernel TIPC DoS Vulnerability

CVE-2026-68289 Overview

CVE-2026-68289 is an integer overflow vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw affects the tipc_recvmsg() and tipc_recvstream() functions in net/tipc/socket.c. A truncation error occurs when buflen values larger than INT_MAX are passed through min_t(int, ...), wrapping the copy length negative. The negative value propagates to simple_copy_to_iter(), where int-to-size_t promotion produces SIZE_MAX, triggering a WARN_ON and a kernel panic when panic_on_warn is set. The condition is reachable via io_uring provided buffers with a size of 0xFFFFFFFF.

Critical Impact
Local users can trigger a kernel panic through crafted io_uring receive operations on TIPC sockets, resulting in denial of service on systems with panic_on_warn enabled.

Affected Products

Linux kernel — TIPC subsystem (net/tipc/socket.c)
Kernel builds exposing TIPC sockets to unprivileged users
Systems using io_uring with provided buffer rings against TIPC sockets

Discovery Timeline

2026-08-10 - CVE-2026-68289 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68289

Vulnerability Analysis

The vulnerability is a numeric truncation error [CWE-681] combined with an integer overflow [CWE-190] in the TIPC receive path. In tipc_recvmsg(), the code computes the copy length as copy = min_t(int, dlen - offset, buflen);. The buflen argument is declared size_t, but min_t(int, ...) casts both operands to int before comparison.

When buflen exceeds INT_MAX, for example 0xFFFFFFFF supplied via io_uring provided buffers, the cast produces a negative value. The negative operand wins the min comparison and is assigned back to copy. tipc_recvstream() follows the same pattern and inherits the same defect.

The negative copy value flows into simple_copy_to_iter() at net/core/datagram.c:521. That function takes a size_t length parameter, so implicit conversion promotes the negative int to a value near SIZE_MAX. The resulting sanity check triggers WARN_ON, and kernels configured with panic_on_warn transition directly to Kernel panic - not syncing.

Root Cause

The root cause is the incorrect type argument to min_t. Using int to compare a size_t against another size_t narrows both values before comparison. This discards the upper 32 bits on 64-bit systems and reinterprets large unsigned values as negative signed integers.

Attack Vector

An unprivileged local process opens a TIPC socket and issues an io_uringrecvmsg operation referencing a provided buffer with length 0xFFFFFFFF. The oversized buffer length propagates into tipc_recvmsg() unchecked, triggering the truncation. No remote network access is required, and no elevated privileges are needed beyond the ability to open a TIPC socket and use io_uring.

Verified code examples are not published for this issue. Refer to the upstream fixes at git.kernel.org commit 47f42ff521b4 and git.kernel.org commit fe9bf32bb18f for the exact source-level change.

Detection Methods for CVE-2026-68289

Indicators of Compromise

Kernel panic messages referencing simple_copy_to_iter+0x9e/0xd0 in net/core/datagram.c.
Call traces containing tipc_recvmsg+0x3d7/0xe80 or tipc_recvstream followed by io_recvmsg.
WARN_ON entries in dmesg originating from __skb_datagram_iter during TIPC receive operations.

Detection Strategies

Audit running kernels for the presence of the fix commits 47f42ff521b4 and fe9bf32bb18f in the TIPC socket source.
Enumerate processes holding TIPC sockets (ss -x or /proc/net/tipc/) and correlate with io_uring usage.
Alert on unexpected kernel panic events on hosts where TIPC is not required for workload function.

Monitoring Recommendations

Forward kernel logs to a centralized log store and search for tipc_recvmsg or tipc_recvstream in warning and panic events.
Track loading of the tipc kernel module on production hosts using auditd rules on init_module and finit_module.
Monitor for repeated crash-restart cycles on hosts that expose TIPC to unprivileged users.

How to Mitigate CVE-2026-68289

Immediate Actions Required

Apply the upstream TIPC fixes to your kernel tree or upgrade to a stable release that includes commits 47f42ff521b4 and fe9bf32bb18f.
Blacklist the tipc module on hosts that do not require inter-process communication over TIPC.
Disable panic_on_warn on non-critical systems to prevent a WARN_ON from escalating into a full outage.

Patch Information

The fix changes min_t(int, ...) to min_t(size_t, ...) in both tipc_recvmsg() and tipc_recvstream(). The resulting value is always bounded by dlen - offset, which cannot exceed the TIPC maximum message size of 0x1ffff bytes, so narrowing to int on assignment is safe. Patches are available at git.kernel.org commit 47f42ff521b4 and git.kernel.org commit fe9bf32bb18f.

Workarounds

Prevent unprivileged loading of the TIPC module by adding install tipc /bin/true to /etc/modprobe.d/.
Restrict io_uring availability using sysctl kernel.io_uring_disabled=2 on hosts where it is not required.
Apply seccomp or LSM policies that block AF_TIPC socket creation for unprivileged processes.

bash

# Configuration example
echo 'install tipc /bin/true' | sudo tee /etc/modprobe.d/disable-tipc.conf
sudo sysctl -w kernel.io_uring_disabled=2
echo 'kernel.io_uring_disabled=2' | sudo tee -a /etc/sysctl.d/99-harden.conf