Answer in brief
CVE-2026-68289 records a Unknown severity vulnerability in tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <fe9bf32bb18f2d35789d4960fb007d1059bbaa38 || >=e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <47f42ff521b4eeb46e82f9a46a4783a99f7570d7 | fe9bf32bb18f2d35789d4960fb007d1059bbaa38, 47f42ff521b4eeb46e82f9a46a4783a99f7570d7 |
| Linux/Linuxgeneric | 4.12 | Not reported |
| Linux/Linuxgeneric | >=e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <1b6066313b9b8fac870483bf7a26d6bd56579747 || >=e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <7364014fdc289225229eb08de8bcbf4580e78e4d || >=e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <fe9bf32bb18f2d35789d4960fb007d1059bbaa38 || >=e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <47f42ff521b4eeb46e82f9a46a4783a99f7570d7 | 1b6066313b9b8fac870483bf7a26d6bd56579747, 7364014fdc289225229eb08de8bcbf4580e78e4d, fe9bf32bb18f2d35789d4960fb007d1059bbaa38, 47f42ff521b4eeb46e82f9a46a4783a99f7570d7 |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern. Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0 Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.
Quoted source text, attributed separately from HOL analysis.