PT-2026-35014 · Linux · Linux

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-31662

NVD

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix bc ackers underflow on duplicate GRP ACK MSG

The GRP ACK MSG handler in tipc group proto rcv() currently decrements bc ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round.

Because bc ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc group bc cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated.

Fix this by ignoring duplicate or stale ACKs before touching bc acked or bc ackers. This makes repeated GRP ACK MSG handling idempotent and prevents the underflow path.

Related Identifiers

CVE-2026-31662

Affected Products

Linux

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-31662 · Security Note
• https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92 · Note
• https://twitter.com/CVEnew/status/2047731914568548532 · Twitter Post
• https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8 · Note
• https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412 · Note
• https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6 · Note
• https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682 · Note
• https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711 · Note
• https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3 · Note
• https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8 · Note