CVE-2026-98550
Description
A flaw was found in the TIPC (Transparent Inter-Process Communication) subsystem of the Linux kernel. This flaw allows an attacker to cause a Denial of Service (DoS) by sending unexpected or duplicate group acknowledgment messages. Due to improper validation of incoming protocol messages, an internal acknowledgment counter can underflow, permanently placing the socket into a congested state and blocking all subsequent broadcast communication.
Statement
This vulnerability is rated as Important severity because an unauthenticated network attacker can cause an unrecoverable denial of service by transmitting invalid group acknowledgment frames, leaving broadcast sockets permanently stalled. Under standard Red Hat Enterprise Linux configurations, the TIPC kernel module is not loaded by default, limiting the potential risk strictly to deployments where TIPC networking is actively utilized.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict sequence verification and reject unexpected GRP_ACK_MSG messages in the TIPC kernel subsystem before decrementing bc_ackers: upgrade to the fixed Kernel/Kernel Ivos Qualcomm/Kernel Rt/Openshift/Ose Rhel Coreos/Kpatch builds, which drop GRP_ACK_MSG immediately if grp->bc_ackers is zero, require acked to strictly equal grp->bc_snd_nxt, and reject duplicate acknowledgments, closing all 2 injection vectors (unexpected GRP_ACK_MSG when bc_ackers is zero, stale sequence ACK injection exploiting the sequence gap in active broadcast rounds). Until patched, this is only a concern on Linux systems running the TIPC kernel module with active or listening group communication sockets — Non-Linux platforms are unaffected — so Restrict network connectivity capable of delivering TIPC traffic to target nodes and avoid loading the TIPC kernel module where group sockets are not needed. As a compensating measure, Enable compiler integer overflow and conversion checks or UBSan integer sanitization to trap runtime unsigned integer underflows when bc_ackers is decremented below zero. These controls limit blast radius and contain exploitation, but they do not fix the underlying TIPC acknowledgment integer underflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
