Answer in brief
CVE-2026-74282 records a Unknown severity vulnerability in tipc: prevent snt_unacked underflow on CONN_ACK. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-74282 records a Unknown severity vulnerability in tipc: prevent snt_unacked underflow on CONN_ACK. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=10724cc7bb7832b482df049c20fd824d928c5eaa <3388145d258cf2c4c98278e3987296007d30672e || >=10724cc7bb7832b482df049c20fd824d928c5eaa <67e55b054bf8025658dc0e255057f2a6236416bd || >=10724cc7bb7832b482df049c20fd824d928c5eaa <96f91b8ae1a489b3eca137e7acf42cf985fb8939 || >=10724cc7bb7832b482df049c20fd824d928c5eaa <47ed873e4ceda34098bd46d8e96b4bb13cad3a04 || >=10724cc7bb7832b482df049c20fd824d928c5eaa <b44bebdd32c9ff66ee2aebfc317ced44bedd9335 || >=10724cc7bb7832b482df049c20fd824d928c5eaa <3cfa3d8e0dc167850edeb5bf5a07757db83fd54e || >=10724cc7bb7832b482df049c20fd824d928c5eaa <1e2c956745777e6ffdee7f30da5935741c03ee1e || >=10724cc7bb7832b482df049c20fd824d928c5eaa <ab3e10b44ba5411779aac7afd2477917dd77750f | 3388145d258cf2c4c98278e3987296007d30672e, 67e55b054bf8025658dc0e255057f2a6236416bd, 96f91b8ae1a489b3eca137e7acf42cf985fb8939, 47ed873e4ceda34098bd46d8e96b4bb13cad3a04, b44bebdd32c9ff66ee2aebfc317ced44bedd9335, 3cfa3d8e0dc167850edeb5bf5a07757db83fd54e, 1e2c956745777e6ffdee7f30da5935741c03ee1e, ab3e10b44ba5411779aac7afd2477917dd77750f |
| Linux/Linuxgeneric | 4.7 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt_unacked underflow on CONN_ACK tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt_unacked without checking that it does not exceed the number of messages actually outstanding: tsk->snt_unacked -= msg_conn_ack(hdr); msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK message. If the ack count is larger than snt_unacked, the subtraction wraps to a near-maximum value, leaving tsk_conn_cong() permanently true and starving the connection of further transmits. Validate the ACK count at the start of the CONN_ACK block and drop the message if it acknowledges more messages than are outstanding. A peer (or, for a local connection, the connected peer socket) can otherwise wedge a TIPC connection's send side by sending an oversized connection ack.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=10724cc7bb7832b482df049c20fd824d928c5eaa <3388145d258cf2c4c98278e3987296007d30672e || >=10724cc7bb7832b482df049c20fd824d928c5eaa <67e55b054bf8025658dc0e255057f2a6236416bd || >=10724cc7bb7832b482df049c20fd824d928c5eaa <96f91b8ae1a489b3eca137e7acf42cf985fb8939 || >=10724cc7bb7832b482df049c20fd824d928c5eaa <47ed873e4ceda34098bd46d8e96b4bb13cad3a04 || >=10724cc7bb7832b482df049c20fd824d928c5eaa <b44bebdd32c9ff66ee2aebfc317ced44bedd9335 || >=10724cc7bb7832b482df049c20fd824d928c5eaa <3cfa3d8e0dc167850edeb5bf5a07757db83fd54e || >=10724cc7bb7832b482df049c20fd824d928c5eaa <1e2c956745777e6ffdee7f30da5935741c03ee1e || >=10724cc7bb7832b482df049c20fd824d928c5eaa <ab3e10b44ba5411779aac7afd2477917dd77750f | 3388145d258cf2c4c98278e3987296007d30672e, 67e55b054bf8025658dc0e255057f2a6236416bd, 96f91b8ae1a489b3eca137e7acf42cf985fb8939, 47ed873e4ceda34098bd46d8e96b4bb13cad3a04, b44bebdd32c9ff66ee2aebfc317ced44bedd9335, 3cfa3d8e0dc167850edeb5bf5a07757db83fd54e, 1e2c956745777e6ffdee7f30da5935741c03ee1e, ab3e10b44ba5411779aac7afd2477917dd77750f |
| Linux/Linuxgeneric | 4.7 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt_unacked underflow on CONN_ACK tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt_unacked without checking that it does not exceed the number of messages actually outstanding: tsk->snt_unacked -= msg_conn_ack(hdr); msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK message. If the ack count is larger than snt_unacked, the subtraction wraps to a near-maximum value, leaving tsk_conn_cong() permanently true and starving the connection of further transmits. Validate the ACK count at the start of the CONN_ACK block and drop the message if it acknowledges more messages than are outstanding. A peer (or, for a local connection, the connected peer socket) can otherwise wedge a TIPC connection's send side by sending an oversized connection ack.
Quoted source text, attributed separately from HOL analysis.