CVE-2026-68289

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

In tipc_recvmsg(), the copy length is computed as:

copy = min_t(int, dlen - offset, buflen);

buflen is size_t but min_t(int, ...) casts it to int. When buflen

exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it

wraps negative, wins the comparison, and the negative copy length

propagates to simple_copy_to_iter() where int-to-size_t promotion

makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the

same pattern.

Kernel panic - not syncing: kernel: panic_on_warn set ...

RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)

Call Trace:

__skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)

skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)

tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)

io_recvmsg+0x47e/0xda0

Fix by changing min_t(int, ...) to min_t(size_t, ...) in both

functions.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References