{"id":"CVE-2026-68289","revision":"4f6e968daec64602b31fd4fcdce0d01a","records":[{"revision":"4f6e968daec64602b31fd4fcdce0d01a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68289","aliases":[],"title":"tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()\n\nIn tipc_recvmsg(), the copy length is computed as:\n\n  copy = min_t(int, dlen - offset, buflen);\n\nbuflen is size_t but min_t(int, ...) casts it to int. When buflen\nexceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it\nwraps negative, wins the comparison, and the negative copy length\npropagates to simple_copy_to_iter() where int-to-size_t promotion\nmakes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the\nsame pattern.\n\n  Kernel panic - not syncing: kernel: panic_on_warn set ...\n  RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)\n  Call Trace:\n   __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)\n   skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)\n   tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)\n   io_recvmsg+0x47e/0xda0\n\nFix by changing min_t(int, ...) to min_t(size_t, ...) in both\nfunctions. The result is always <= (dlen - offset), which is bounded\nby TIPC maximum message size (0x1ffff bytes), so the implicit\nnarrowing on assignment to int copy is always safe.","state":0,"publishedAt":"2026-08-10T12:02:22.101+00:00","modifiedAt":"2026-10-03T10:55:45.132+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/tipc/socket.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e9f8b10101c6da3ab000a2fb17162374c9bd2c69\",\n                            \"lessThan\": \"9fd4f92671146b068809b6c34b50346cb30cf8f7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9f8b10101c6da3ab000a2fb17162374c9bd2c69\",\n                            \"lessThan\": \"93580911f02d1f4a506ec0a6fc4354140c53ffe8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9f8b10101c6da3ab000a2fb17162374c9bd2c69\",\n                            \"lessThan\": \"1b6066313b9b8fac870483bf7a26d6bd56579747\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9f8b10101c6da3ab000a2fb17162374c9bd2c69\",\n                            \"lessThan\": \"7364014fdc289225229eb08de8bcbf4580e78e4d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9f8b10101c6da3ab000a2fb17162374c9bd2c69\",\n                            \"lessThan\": \"fe9bf32bb18f2d35789d4960fb007d1059bbaa38\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e9f8b10101c6da3ab000a2fb17162374c9bd2c69\",\n                            \"lessThan\": \"47f42ff521b4eeb46e82f9a46a4783a99f7570d7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/tipc/socket.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/9fd4f92671146b068809b6c34b50346cb30cf8f7","https://git.kernel.org/stable/c/93580911f02d1f4a506ec0a6fc4354140c53ffe8","https://git.kernel.org/stable/c/1b6066313b9b8fac870483bf7a26d6bd56579747","https://git.kernel.org/stable/c/7364014fdc289225229eb08de8bcbf4580e78e4d","https://git.kernel.org/stable/c/fe9bf32bb18f2d35789d4960fb007d1059bbaa38","https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68289","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68289","identifiers":["CVE-2026-68289"]},"retained":false,"historicalAffected":[]}],"coverage":[]}