CVE-2026-74281

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: reject inverted service ranges from peer bindings

tipc_update_nametbl() inserts a binding advertised by a peer node using

the lower and upper service-range bounds taken directly from the wire,

without checking that lower <= upper. The local bind path validates the

ordering (tipc_uaddr_valid()), but the name-distribution path does not.

A binding with lower > upper is inserted at the far end of the

service-range rbtree (keyed on lower) where no lookup or withdrawal can

ever match it (service_range_foreach_match() requires sr->lower <= end).

The publication, its service_range node and the augmented rbtree entry

are then leaked for the lifetime of the namespace, and there is no

per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.

Reject inverted ranges in the network path as well. A peer node can

otherwise leak unbounded binding-table memory by sending PUBLICATION

items with lower > upper.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References