---
id: CVE-2026-68289
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

  In tipc_recvmsg(), the copy length is computed as:

    copy = min_t(int, dlen - offset, buflen);

  buf…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

  In tipc_recvmsg(), the copy length is computed as:

    copy = min_t(int, dlen - offset, buflen);

  buf…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <
    1b6066313b9b8fac870483bf7a26d6bd56579747
  - >-
    Linux >= e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <
    7364014fdc289225229eb08de8bcbf4580e78e4d
  - >-
    Linux >= e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <
    fe9bf32bb18f2d35789d4960fb007d1059bbaa38
  - >-
    Linux >= e9f8b10101c6da3ab000a2fb17162374c9bd2c69 <
    47f42ff521b4eeb46e82f9a46a4783a99f7570d7
  - Linux 4.12
published: '2026-08-10'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:16.603'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68289'
references:
  - url: 'https://git.kernel.org/stable/c/1b6066313b9b8fac870483bf7a26d6bd56579747'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7364014fdc289225229eb08de8bcbf4580e78e4d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fe9bf32bb18f2d35789d4960fb007d1059bbaa38'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00209
epssPercentile: 0.0981
ingestedAt: '2026-09-21T13:37:22.845Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

In tipc_recvmsg(), the copy length is computed as:

  copy = min_t(int, dlen - offset, buflen);

buflen is size_t but min_t(int, ...) casts it to int. When buflen
exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it
wraps negative, wins the comparison, and the negative copy length
propagates to simple_copy_to_iter() where int-to-size_t promotion
makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the
same pattern.

  Kernel panic - not syncing: kernel: panic_on_warn set ...
  RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)
  Call Trace:
   __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)
   skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)
   tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)
   io_recvmsg+0x47e/0xda0

Fix by changing min_t(int, ...) to min_t(size_t, ...) in both
functions. The result is always <= (dlen - offset), which is bounded
by TIPC maximum message size (0x1ffff bytes), so the implicit
narrowing on assignment to int copy is always safe.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.