SECUFOCUSNOW
Home›CVE index›CVE-2026-64450
Review reviewCritical

CVE-2026-64450

Linux

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check that the record actually fits in the message data area, msg_data_sz(). The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen) break;"), but the broadcast caller tipc_bcast_sync_rcv(...

CVSS
9.1
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 9.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check that the record actually fits in the message data area, msg_data_sz(). The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen) break;"), but the broadcast caller tipc_bcast_sync_rcv(...

Affected product and versions

Product
Linux
Affected versions
>= d7626b5acff9227e2a65da636a53e09bdafdc0aa < 055663d21dc4336f67933ab26bef3c5934be6324, >= d7626b5acff9227e2a65da636a53e09bdafdc0aa < 016f5995c37a5a2c45198308f830f244517d70b7, >= d7626b5acff9227e2a65da636a53e09bdafdc0aa < 74b45af86a767594ba52330cd440ea84e24d700d, >= d7626b5acff9227e2a65da636a53e09bdafdc0aa < 9a51115fcdc78687c8852bf93a1db3951dbb223b, >= d7626b5acff9227e2a65da636a53e09bdafdc0aa < a21ed5064217cc33726da6c7ef1a520eba43aea1, >= d7626b5acff9227e2a65da636a53e09bdafdc0aa < 2de42e268174766cb2e2b90721afdfdff70e0d8d, >= d7626b5acff9227e2a65da636a53e09bdafdc0aa < f333b6851bdf326fd2134133272dbbed0c94d921, >= d7626b5acff9227e2a65da636a53e09bdafdc0aa < 2b66974a1b6134a4bbc3bfed181f7418f688eb54, >= 5.8
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE
Not available
CVE-2026-64450 — Linux | SECUFOCUS NOW