---
id: CVE-2026-31662
title: 'tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

  The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
  bc_ackers on every inbound group ACK, eve…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    a7db57ccca21f5801609065473c89a38229ecb92
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    575faea557f1a184a5f09661bd47ebd3ef3769f8
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    3bcf7aca63f0bcd679ae28e9b99823c608e59ce3
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    a2ea1ef0167d7a84730638d05c20ccdc421b14b6
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    1b6f13f626665cac67ba5a012765427680518711
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682
  - >-
    Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 <
    48a5fe38772b6f039522469ee6131a67838221a8
  - Linux 4.15
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:11:44.605157Z'
published: '2026-04-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:20.659Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31662'
references:
  - url: 'https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92'
  - url: 'https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412'
  - url: 'https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8'
  - url: 'https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3'
  - url: 'https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6'
  - url: 'https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711'
  - url: 'https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682'
  - url: 'https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8'
tags:
  - cve.org
epss: 0.00389
epssPercentile: 0.31392
ingestedAt: '2026-10-16T17:24:46.667Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
bc_ackers on every inbound group ACK, even when the same member has
already acknowledged the current broadcast round.

Because bc_ackers is a u16, a duplicate ACK received after the last
legitimate ACK wraps the counter to 65535. Once wrapped,
tipc_group_bc_cong() keeps reporting congestion and later group
broadcasts on the affected socket stay blocked until the group is
recreated.

Fix this by ignoring duplicate or stale ACKs before touching bc_acked or
bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and
prevents the underflow path.

## Affected

- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < a7db57ccca21f5801609065473c89a38229ecb92`
- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < 36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412`
- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < 575faea557f1a184a5f09661bd47ebd3ef3769f8`
- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3`
- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < a2ea1ef0167d7a84730638d05c20ccdc421b14b6`
- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < 1b6f13f626665cac67ba5a012765427680518711`
- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682`
- `Linux >= 2f487712b89376fce267223bbb0db93d393d4b09 < 48a5fe38772b6f039522469ee6131a67838221a8`
- `Linux 4.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.