CVE-2026-68297: Linux Kernel TIPC MTU Truncation DoS Flaw

CVE-2026-68297 Overview

CVE-2026-68297 is a numeric truncation vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. The flaw resides in the netlink handlers TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET, which accept a user-supplied Maximum Transmission Unit (MTU) but enforce only a minimum bound. MTU values above U16_MAX (65535) pass validation and are silently truncated when assigned to the u16 fields l->mtu and l->advertised_mtu in tipc_link_create(). A value of 65536 truncates to zero, triggering a division by zero in tipc_link_set_queue_limits(). The bug is reachable by an unprivileged local user through a user namespace.

Critical Impact
A local unprivileged user can crash the kernel by submitting an oversized MTU to the TIPC netlink interface through a user namespace.

Affected Products

Linux kernel with TIPC networking support enabled
Distributions shipping kernels that permit unprivileged user namespaces
Systems using TIPC bearers or media configured via netlink

Discovery Timeline

2026-08-10 - CVE-2026-68297 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68297

Vulnerability Analysis

The TIPC subsystem exposes two netlink commands, TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET, that allow user space to configure media and bearer parameters. Both paths validate the MTU against a lower bound but never check an upper bound. When tipc_link_create() stores the value in the u16 fields l->mtu and l->advertised_mtu, the high bits are discarded. A submitted MTU of 65536 becomes 0. The queue-limit calculation TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE) then divides by zero and crashes the kernel. Values between 65537 and 131071 truncate to small positive numbers, corrupting link behavior instead of panicking.

Root Cause

The root cause is missing upper-bound validation on a user-supplied integer that is later narrowed from u32 to u16. Two independent code paths exhibit the flaw: tipc_udp_mtu_bad() invoked by __tipc_nl_media_set(), and the inline check in __tipc_nl_bearer_set() at bearer.c:1160. Neither rejects values above U16_MAX before the truncation occurs in tipc_link_create().

Attack Vector

Exploitation is local. An unprivileged process creates a user namespace, gains CAP_NET_ADMIN inside it, and issues a TIPC netlink message setting the MTU to a value greater than 65535. The crash stack traverses tipc_udp_recv → tipc_rcv → tipc_disc_rcv → tipc_node_check_dest → tipc_link_create → tipc_link_set_queue_limits, where the division by zero terminates the kernel. Because the trigger requires only local netlink access, the impact is denial of service against the host.

No verified public exploit code was released with this advisory. See the Linux Kernel Commit Log for the upstream fix, which adds an explicit rejection of MTU values above U16_MAX in both affected paths.

Detection Methods for CVE-2026-68297

Indicators of Compromise

Kernel oops or panic referencing tipc_link_set_queue_limits or tipc_link_create in the call stack
Unexpected TIPC bearer or media reconfiguration events preceding a host crash
Processes creating user namespaces and issuing TIPC netlink messages on hosts that do not normally use TIPC

Detection Strategies

Audit netlink sockets of family NETLINK_GENERIC targeting the TIPC generic netlink family for TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET commands
Monitor unshare(CLONE_NEWUSER) and clone(CLONE_NEWUSER) calls from non-container workloads followed by network configuration syscalls
Alert on kernel log messages such as divide error or Oops correlated with net/tipc/link.c

Monitoring Recommendations

Forward kern.log and journalctl -k output to a central log store and alert on TIPC-related stack traces
Track loaded kernel modules and flag hosts where tipc loads unexpectedly through modprobe autoload
Correlate user namespace creation with subsequent privileged operations using auditd rules on unshare and setns

How to Mitigate CVE-2026-68297

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the commits 1b8fb5a2, 9f29cd8a, c1cda72f, f02334a9, and f4013598b
Blacklist the tipc kernel module on hosts that do not use TIPC by adding install tipc /bin/true to /etc/modprobe.d/
Restrict unprivileged user namespace creation on affected hosts until patches are deployed

Patch Information

The fix rejects MTU values above U16_MAX in both tipc_udp_mtu_bad() and the inline check in __tipc_nl_bearer_set(). Patched commits are available in the stable trees: 1b8fb5a2, 9f29cd8a, c1cda72f, f02334a9, and f4013598b. Rebuild and reboot into the patched kernel to apply the fix.

Workarounds

Set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 (systemd) to block unprivileged user namespace creation
Prevent the TIPC module from loading by placing blacklist tipc in /etc/modprobe.d/blacklist-tipc.conf and rebuilding the initramfs
Restrict CAP_NET_ADMIN inside containers and refuse workloads that request it without a business need

bash

# Configuration example
echo 'blacklist tipc' | sudo tee /etc/modprobe.d/blacklist-tipc.conf
echo 'install tipc /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-tipc.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
sudo update-initramfs -u