CVE-2026-43411

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix divide-by-zero in tipc_sk_filter_connect()

A user can set conn_timeout to any value via

setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a

SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in

tipc_sk_filter_connect() executes:

delay %= (tsk->conn_timeout / 4);

If conn_timeout is in the range [0, 3], the integer division yields 0,

and the modulo operation triggers a divide-by-zero exception, causing a

kernel oops/panic.

Fix this by clamping conn_timeout to a minimum of 4 at the point of use

in tipc_sk_filter_connect().

Oops: divide error: 0000 [#1] SMP KASAN NOPTI

CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+

RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)

Call Trace:

tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)

__release_sock (i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References