CVE-2026-74281

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74281", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.880Z", "datePublished": "2026-08-15T05:57:51.423Z", "dateUpdated": "2026-10-16T18:55:29.746Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:22.291Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject inverted service ranges from peer bindings\n\ntipc_update_nametbl() inserts a binding advertised by a peer node using\nthe lower and upper service-range bounds taken directly from the wire,\nwithout checking that lower <= upper. The local bind path validates the\nordering (tipc_uaddr_valid()), but the name-distribution path does not.\n\nA binding with lower > upper is inserted at the far end of the\nservice-range rbtree (keyed on lower) where no lookup or withdrawal can\never match it (service_range_foreach_match() requires sr->lower <= end).\nThe publication, its service_range node and the augmented rbtree entry\nare then leaked for the lifetime of the namespace, and there is no\nper-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.\n\nReject inverted ranges in the network path as well. A peer node can\notherwise leak unbounded binding-table memory by sending PUBLICATION\nitems with lower > upper."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - NAME_DISTRIBUTOR PUBLICATION messages from a remote TIPC peer are processed via tipc_rcv/tipc_link_rcv into tipc_named_rcv with no local syscall, matching Network attack vector for in-kernel protocol handlers.\nAC:L - Sending PUBLICATION items with lower>upper reliably triggers permanent leaked binding-table entries; attacker controls both ends of the exchange over an established link with no race or victim-dependent timing.\nPR:N - A malicious or compromised cluster peer can send crafted name-table updates without any account or capability on the victim; TIPC accepts peer publications after normal link setup without per-message authentication by default.\nUI:N - Victim nodes ingest peer binding advertisements automatically during TIPC name distribution; no administrator or user action is required beyond routine cluster connectivity.\nS:U - The flaw only causes unreachable kernel heap growth in the victim's network namespace and does not cross VM, container, or IOMMU security boundaries.\nC:N - The issue is allocation without corresponding free of publication/service_range objects; it does not read or disclose kernel or user data beyond attacker-chosen binding fields.\nI:N - Inverted ranges create orphaned nametable metadata without corrupting adjacent memory or modifying legitimate bindings, sockets, or user data.\nA:H - Each unique inverted publication permanently leaks publication, service_range, and rbtree nodes with no per-peer cap and failed cleanup on peer loss/withdrawal, enabling repeatable remote kernel memory exhaustion and OOM."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/name_distr.c"], "versions": [{"version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "cd1955f81bd8ebeef51b324989ac871ad1947fb6", "status": "affected", "versionType": "git"}, {"version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "f683200b83a0085d4e11abea8c1fdd9fdfb95b0b", "status": "affected", "versionType": "git"}, {"version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "f1715d92ee3095d9215b493a8603a81f646fcf61", "status": "affected", "versionType": "git"}, {"version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "581ef56e5c34d475056ce086dc2ba0e872ba6857", "status": "affected", "versionType": "git"}, {"version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "7e401233f9bb74a626e70698d0d62f3a94ac0676", "status": "affected", "versionType": "git"}, {"version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "973bf0ed896b9898668dbadb82ed849d7d573010", "status": "affected", "versionType": "git"}, {"version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "2afb648f7b99216c687db1f89739c995e1144153", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/name_distr.c"], "versions": [{"version": "4.17", "status": "affected"}, {"version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6"}, {"url": "https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b"}, {"url": "https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61"}, {"url": "https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857"}, {"url": "https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676"}, {"url": "https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010"}, {"url": "https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153"}], "title": "tipc: reject inverted service ranges from peer bindings", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:52:04.430800Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:29.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:52:04.430800Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:52:05.439Z"}}], "cna": {"title": "tipc: reject inverted service ranges from peer bindings", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - NAME_DISTRIBUTOR PUBLICATION messages from a remote TIPC peer are processed via tipc_rcv/tipc_link_rcv into tipc_named_rcv with no local syscall, matching Network attack vector for in-kernel protocol handlers.\nAC:L - Sending PUBLICATION items with lower>upper reliably triggers permanent leaked binding-table entries; attacker controls both ends of the exchange over an established link with no race or victim-dependent timing.\nPR:N - A malicious or compromised cluster peer can send crafted name-table updates without any account or capability on the victim; TIPC accepts peer publications after normal link setup without per-message authentication by default.\nUI:N - Victim nodes ingest peer binding advertisements automatically during TIPC name distribution; no administrator or user action is required beyond routine cluster connectivity.\nS:U - The flaw only causes unreachable kernel heap growth in the victim's network namespace and does not cross VM, container, or IOMMU security boundaries.\nC:N - The issue is allocation without corresponding free of publication/service_range objects; it does not read or disclose kernel or user data beyond attacker-chosen binding fields.\nI:N - Inverted ranges create orphaned nametable metadata without corrupting adjacent memory or modifying legitimate bindings, sockets, or user data.\nA:H - Each unique inverted publication permanently leaks publication, service_range, and rbtree nodes with no per-peer cap and failed cleanup on peer loss/withdrawal, enabling repeatable remote kernel memory exhaustion and OOM."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "cd1955f81bd8ebeef51b324989ac871ad1947fb6", "versionType": "git"}, {"status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "f683200b83a0085d4e11abea8c1fdd9fdfb95b0b", "versionType": "git"}, {"status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "f1715d92ee3095d9215b493a8603a81f646fcf61", "versionType": "git"}, {"status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "581ef56e5c34d475056ce086dc2ba0e872ba6857", "versionType": "git"}, {"status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "7e401233f9bb74a626e70698d0d62f3a94ac0676", "versionType": "git"}, {"status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "973bf0ed896b9898668dbadb82ed849d7d573010", "versionType": "git"}, {"status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "lessThan": "2afb648f7b99216c687db1f89739c995e1144153", "versionType": "git"}], "programFiles": ["net/tipc/name_distr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"status": "unaffected", "version": "0", "lessThan": "4.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/tipc/name_distr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6"}, {"url": "https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b"}, {"url": "https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61"}, {"url": "https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857"}, {"url": "https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676"}, {"url": "https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010"}, {"url": "https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject inverted service ranges from peer bindings\n\ntipc_update_nametbl() inserts a binding advertised by a peer node using\nthe lower and upper service-range bounds taken directly from the wire,\nwithout checking that lower <= upper. The local bind path validates the\nordering (tipc_uaddr_valid()), but the name-distribution path does not.\n\nA binding with lower > upper is inserted at the far end of the\nservice-range rbtree (keyed on lower) where no lookup or withdrawal can\never match it (service_range_foreach_match() requires sr->lower <= end).\nThe publication, its service_range node and the augmented rbtree entry\nare then leaked for the lifetime of the namespace, and there is no\nper-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.\n\nReject inverted ranges in the network path as well. A peer node can\notherwise leak unbounded binding-table memory by sending PUBLICATION\nitems with lower > upper."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:22.291Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74281", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:29.746Z", "dateReserved": "2026-08-15T05:44:03.880Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:57:51.423Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tipc/name_distr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cd1955f81bd8ebeef51b324989ac871ad1947fb6", "status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "versionType": "git"}, {"lessThan": "f683200b83a0085d4e11abea8c1fdd9fdfb95b0b", "status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "versionType": "git"}, {"lessThan": "f1715d92ee3095d9215b493a8603a81f646fcf61", "status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "versionType": "git"}, {"lessThan": "581ef56e5c34d475056ce086dc2ba0e872ba6857", "status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "versionType": "git"}, {"lessThan": "7e401233f9bb74a626e70698d0d62f3a94ac0676", "status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "versionType": "git"}, {"lessThan": "973bf0ed896b9898668dbadb82ed849d7d573010", "status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "versionType": "git"}, {"lessThan": "2afb648f7b99216c687db1f89739c995e1144153", "status": "affected", "version": "37922ea4a3105176357c8d565a9d982c4a08714a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tipc/name_distr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"lessThan": "4.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject inverted service ranges from peer bindings\n\ntipc_update_nametbl() inserts a binding advertised by a peer node using\nthe lower and upper service-range bounds taken directly from the wire,\nwithout checking that lower <= upper. The local bind path validates the\nordering (tipc_uaddr_valid()), but the name-distribution path does not.\n\nA binding with lower > upper is inserted at the far end of the\nservice-range rbtree (keyed on lower) where no lookup or withdrawal can\never match it (service_range_foreach_match() requires sr->lower <= end).\nThe publication, its service_range node and the augmented rbtree entry\nare then leaked for the lifetime of the namespace, and there is no\nper-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.\n\nReject inverted ranges in the network path as well. A peer node can\notherwise leak unbounded binding-table memory by sending PUBLICATION\nitems with lower > upper."}], "id": "CVE-2026-74281", "lastModified": "2026-10-16T19:17:36.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74281", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:52:04.430800Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:27.547", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tipc: reject inverted service ranges from peer bindings", "id": "2516857", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516857"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntipc: reject inverted service ranges from peer bindings\ntipc_update_nametbl() inserts a binding advertised by a peer node using\nthe lower and upper service-range bounds taken directly from the wire,\nwithout checking that lower <= upper. The local bind path validates the\nordering (tipc_uaddr_valid()), but the name-distribution path does not.\nA binding with lower > upper is inserted at the far end of the\nservice-range rbtree (keyed on lower) where no lookup or withdrawal can\never match it (service_range_foreach_match() requires sr->lower <= end).\nThe publication, its service_range node and the augmented rbtree entry\nare then leaked for the lifetime of the namespace, and there is no\nper-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.\nReject inverted ranges in the network path as well. A peer node can\notherwise leak unbounded binding-table memory by sending PUBLICATION\nitems with lower > upper.", "A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) module. A remote attacker, acting as a peer node, could exploit this by sending specially crafted PUBLICATION messages with inverted service ranges. This oversight in validating service range bounds allows the attacker to cause unbounded memory leaks in the binding table, leading to a denial of service (DoS) for the affected system."], "name": "CVE-2026-74281", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74281\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74281\nhttps://lore.kernel.org/linux-cve-announce/2026081546-CVE-2026-74281-fc97@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37922ea4a3105176357c8d565a9d982c4a08714a,cd1955f81bd8ebeef51b324989ac871ad1947fb6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37922ea4a3105176357c8d565a9d982c4a08714a,f683200b83a0085d4e11abea8c1fdd9fdfb95b0b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37922ea4a3105176357c8d565a9d982c4a08714a,f1715d92ee3095d9215b493a8603a81f646fcf61)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37922ea4a3105176357c8d565a9d982c4a08714a,581ef56e5c34d475056ce086dc2ba0e872ba6857)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37922ea4a3105176357c8d565a9d982c4a08714a,7e401233f9bb74a626e70698d0d62f3a94ac0676)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37922ea4a3105176357c8d565a9d982c4a08714a,973bf0ed896b9898668dbadb82ed849d7d573010)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37922ea4a3105176357c8d565a9d982c4a08714a,2afb648f7b99216c687db1f89739c995e1144153)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.212,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.178,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.145,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.97,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.40,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.5,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:45:06.851058+00:00", "updated": "2026-08-22T04:00:12.140195+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}