{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31662","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-03-09T15:48:24.129Z","datePublished":"2026-04-24T14:45:12.593Z","dateUpdated":"2026-08-05T12:24:12.893Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:24:12.893Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler processes TIPC GROUP_PROTOCOL messages received over configured TIPC bearers, including UDP/IP bearers that accept network packets from peer nodes. A malicious remote TIPC peer can send crafted or duplicate GRP_ACK_MSG packets to the victim group socket.\nAC:L - There is no race or hard-to-control condition; after joining or appearing as a group member, the attacker can send an ACK and then a stale or duplicate ACK with a new link sequence number. The triggering state is a normal replicast group broadcast with ACKs enabled.\nPR:N - The attacker does not need privileges on the victim system; TIPC discovery/group protocol messages are accepted from network peers after normal bearer/node establishment, with no mandatory authentication in the vulnerable path. Optional TIPC crypto or deployment filtering is not required for the vulnerable code path.\nUI:N - No victim user action is required once the vulnerable TIPC group service is running. The attacker triggers the bug by sending network protocol messages.\nS:U - The impact remains within the same kernel/TIPC communication security authority. There is no VM escape, sandbox escape, or cross-authority boundary bypass.\nC:N - The bug is a logical u16 counter underflow in group broadcast ACK accounting, not a memory disclosure or memory corruption primitive. It does not provide a way to read confidential data.\nI:N - The attacker corrupts protocol accounting state only to block later broadcasts; there is no unauthorized data modification, arbitrary write, or control-flow impact. The security consequence is denial of service rather than integrity compromise.\nA:H - Wrapping bc_ackers to 65535 makes tipc_group_bc_cong() keep reporting congestion, so subsequent group broadcasts on the affected socket remain blocked until the group is recreated. In a TIPC-based clustered or control deployment this is a persistent, remotely triggerable loss of availability for the affected communication channel."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/group.c"],"versions":[{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"a7db57ccca21f5801609065473c89a38229ecb92","status":"affected","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412","status":"affected","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"575faea557f1a184a5f09661bd47ebd3ef3769f8","status":"affected","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"3bcf7aca63f0bcd679ae28e9b99823c608e59ce3","status":"affected","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"a2ea1ef0167d7a84730638d05c20ccdc421b14b6","status":"affected","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"1b6f13f626665cac67ba5a012765427680518711","status":"affected","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682","status":"affected","versionType":"git"},{"version":"2f487712b89376fce267223bbb0db93d393d4b09","lessThan":"48a5fe38772b6f039522469ee6131a67838221a8","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tipc/group.c"],"versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","status":"unaffected","versionType":"semver"},{"version":"5.10.253","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.203","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.169","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.135","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.82","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.23","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.13","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.169"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.135"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12.82"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.18.23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.19.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92"},{"url":"https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412"},{"url":"https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8"},{"url":"https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3"},{"url":"https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6"},{"url":"https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711"},{"url":"https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682"},{"url":"https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8"}],"title":"tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG","x_generator":{"engine":"bippy-1.2.0"}}}}