---
id: CVE-2026-74282
title: 'tipc: prevent snt_unacked underflow on CONN_ACK'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: prevent snt_unacked underflow on CONN_ACK

  tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count
  from the unsigned 16-bit send counter snt_una…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    3388145d258cf2c4c98278e3987296007d30672e
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    67e55b054bf8025658dc0e255057f2a6236416bd
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    96f91b8ae1a489b3eca137e7acf42cf985fb8939
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    47ed873e4ceda34098bd46d8e96b4bb13cad3a04
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    b44bebdd32c9ff66ee2aebfc317ced44bedd9335
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    3cfa3d8e0dc167850edeb5bf5a07757db83fd54e
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    1e2c956745777e6ffdee7f30da5935741c03ee1e
  - >-
    Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa <
    ab3e10b44ba5411779aac7afd2477917dd77750f
  - Linux 4.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T18:52:07.516475Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:29.895Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74282'
references:
  - url: 'https://git.kernel.org/stable/c/3388145d258cf2c4c98278e3987296007d30672e'
  - url: 'https://git.kernel.org/stable/c/67e55b054bf8025658dc0e255057f2a6236416bd'
  - url: 'https://git.kernel.org/stable/c/96f91b8ae1a489b3eca137e7acf42cf985fb8939'
  - url: 'https://git.kernel.org/stable/c/47ed873e4ceda34098bd46d8e96b4bb13cad3a04'
  - url: 'https://git.kernel.org/stable/c/b44bebdd32c9ff66ee2aebfc317ced44bedd9335'
  - url: 'https://git.kernel.org/stable/c/3cfa3d8e0dc167850edeb5bf5a07757db83fd54e'
  - url: 'https://git.kernel.org/stable/c/1e2c956745777e6ffdee7f30da5935741c03ee1e'
  - url: 'https://git.kernel.org/stable/c/ab3e10b44ba5411779aac7afd2477917dd77750f'
tags:
  - cve.org
epss: 0.00716
epssPercentile: 0.5284
ingestedAt: '2026-10-16T19:46:24.385Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: prevent snt_unacked underflow on CONN_ACK

tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count
from the unsigned 16-bit send counter snt_unacked without checking that it
does not exceed the number of messages actually outstanding:

	tsk->snt_unacked -= msg_conn_ack(hdr);

msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK
message. If the ack count is larger than snt_unacked, the subtraction
wraps to a near-maximum value, leaving tsk_conn_cong() permanently true
and starving the connection of further transmits.

Validate the ACK count at the start of the CONN_ACK block and drop the
message if it acknowledges more messages than are outstanding. A peer (or,
for a local connection, the connected peer socket) can otherwise wedge a
TIPC connection's send side by sending an oversized connection ack.

## Affected

- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < 3388145d258cf2c4c98278e3987296007d30672e`
- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < 67e55b054bf8025658dc0e255057f2a6236416bd`
- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < 96f91b8ae1a489b3eca137e7acf42cf985fb8939`
- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < 47ed873e4ceda34098bd46d8e96b4bb13cad3a04`
- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < b44bebdd32c9ff66ee2aebfc317ced44bedd9335`
- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < 3cfa3d8e0dc167850edeb5bf5a07757db83fd54e`
- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < 1e2c956745777e6ffdee7f30da5935741c03ee1e`
- `Linux >= 10724cc7bb7832b482df049c20fd824d928c5eaa < ab3e10b44ba5411779aac7afd2477917dd77750f`
- `Linux 4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.