CVE-2026-68297

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix u16 MTU truncation in media and bearer MTU validation

Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied

MTU values but only enforce a minimum bound, not a maximum. When a user

sets the MTU to a value exceeding U16_MAX (65535), it passes validation

but is silently truncated when assigned to u16 fields l->mtu and

l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)

truncate to 0, causing a division by zero in tipc_link_set_queue_limits()

which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing

values (e.g. 65537-131071) produce small incorrect MTU values, resulting

in link malfunction behaviors.

Crash stack (triggered as unprivileged user via user namespace):

tipc_link_set_queue_limits net/tipc/link.c:2531

tipc_link_create net/tipc/link.c:520

tipc_node_check_dest net/tipc/node.c:1279

tipc_disc_rcv net/tipc/discover.c:252

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References