CVE-2026-43411

tipc: fix divide-by-zero in tipc_sk_filter_connect()

Published May 8, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix divide-by-zero in tipc_sk_filter_connect()

A user can set conn_timeout to any value via
setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a
SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in
tipc_sk_filter_connect() executes:

delay %= (tsk->conn_timeout / 4);

If conn_timeout is in the range [0, 3], the integer division yields 0,
and the modulo operation triggers a divide-by-zero exception, causing a
kernel oops/panic.

Fix this by clamping conn_timeout to a minimum of 4 at the point of use
in tipc_sk_filter_connect().

Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+
RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)
Call Trace:
tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)
__release_sock (include/net/sock.h:1185 net/core/sock.c:3213)
release_sock (net/core/sock.c:3797)
tipc_connect (net/tipc/socket.c:2570)
__sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)

Analysis

Technical impact

The vulnerability is an integer division by zero in the tipc_sk_filter_connect function of the Linux kernel's TIPC socket module. When the socket option TIPC_CONN_TIMEOUT is set to any value from 0 to 3 via setsockopt, the retry path for a rejected SYN calculates delay %= (tsk->conn_timeout / 4);. Since the division yields zero, the modulo operation triggers a divide‑by‑zero exception, causing a kernel oops and potentially a panic. This results in a denial of service by crashing the kernel.

Affected Systems

The weakness affects all Linux kernel builds that include the TIPC socket module and have not applied the fix that clamps conn_timeout to a minimum of four. No specific distribution or version is singled out; any kernel incorporating the current TIPC implementation before the patch is vulnerable.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity because a kernel crash can bring a system down. EPSS is < 1%, and the issue is not in CISA's KEV catalog. Attackers can trigger the crash by creating a local TIPC socket and calling setsockopt to set TIPC_CONN_TIMEOUT to a low value. The likely attack vector is local, as it requires only execution privileges to create a socket, which does not require network connectivity. Based on the description, it is inferred that no network‑level privilege escalation is needed to exploit the flaw; a local user can induce the crash.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 600feb0a66a98c6b7f6f02b5f3612e75f9b8540f
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 3bc9998041076ee05d3f312a22cee6b2ca35527f
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 579956f9f297eb1b6a5d24de313f3acccee1f9d5
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< a360d3815aae1f00dd71b7714a846482e85cc1f7
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< c2ebfbe63deb7bfd4dc2532bae62a7ed67713272
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 2754e7b3d64748643df867d1ea6fec522914b635
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 6c5a9baa15de240e747263aba435a0951da8d8d2

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.19`	unaffected	≤ 6.18.*
`6.19.9`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6787927475e52f6933e3affce365dabb2aa2fadf,600feb0a66a98c6b7f6f02b5f3612e75f9b8540f)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,3bc9998041076ee05d3f312a22cee6b2ca35527f)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,579956f9f297eb1b6a5d24de313f3acccee1f9d5)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,a360d3815aae1f00dd71b7714a846482e85cc1f7)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,c2ebfbe63deb7bfd4dc2532bae62a7ed67713272)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,2754e7b3d64748643df867d1ea6fec522914b635)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,6c5a9baa15de240e747263aba435a0951da8d8d2)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.20`	affected	semver	—
`[0,4.20)`	unaffected	semver	—
`[5.10.253,5.10.*]`	unaffected	semver	—
`[5.15.203,5.15.*]`	unaffected	semver	—
`[6.1.167,6.1.*]`	unaffected	semver	—
`[6.6.130,6.6.*]`	unaffected	semver	—
`[6.12.78,6.12.*]`	unaffected	semver	—
`[6.18.19,6.18.*]`	unaffected	semver	—
`[6.19.9,6.19.*]`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the patch that clamps conn_timeout to a minimum of four at tipc_sk_filter_connect().
If an immediate upgrade is not possible, avoid setting TIPC_CONN_TIMEOUT to a value less than four by ensuring applications use the default or a safe timeout value or by adding a check in client code before calling setsockopt.
Disabling or removing the TIPC kernel module is a viable temporary measure if TIPC functionality is not required.

Generated by OpenCVE AI on May 21, 2026 at 19:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.123% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/2754e7b3d64748643df867d1ea6fec522914b635
https://git.kernel.org/stable/c/338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3
https://git.kernel.org/stable/c/3bc9998041076ee05d3f312a22cee6b2ca35527f
https://git.kernel.org/stable/c/579956f9f297eb1b6a5d24de313f3acccee1f9d5
https://git.kernel.org/stable/c/600feb0a66a98c6b7f6f02b5f3612e75f9b8540f
https://git.kernel.org/stable/c/6c5a9baa15de240e747263aba435a0951da8d8d2
https://git.kernel.org/stable/c/a360d3815aae1f00dd71b7714a846482e85cc1f7
https://git.kernel.org/stable/c/c2ebfbe63deb7bfd4dc2532bae62a7ed67713272
https://lore.kernel.org/linux-cve-announce/2026050843-CVE-2026-43411-6074@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43411
https://www.cve.org/CVERecord?id=CVE-2026-43411

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 21, 2026 6:15 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-369
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

May 9, 2026 3:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-369

May 9, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://lore.kernel.org/linux-cve-announce/2026050843-CVE-2026-43411-6074@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43411 https://www.cve.org/CVERecord?id=CVE-2026-43411
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

May 8, 2026 6:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-369

May 8, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: fix divide-by-zero in tipc_sk_filter_connect() A user can set conn_timeout to any value via setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in tipc_sk_filter_connect() executes: delay %= (tsk->conn_timeout / 4); If conn_timeout is in the range [0, 3], the integer division yields 0, and the modulo operation triggers a divide-by-zero exception, causing a kernel oops/panic. Fix this by clamping conn_timeout to a minimum of 4 at the point of use in tipc_sk_filter_connect(). Oops: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+ RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362) Call Trace: tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406) __release_sock (include/net/sock.h:1185 net/core/sock.c:3213) release_sock (net/core/sock.c:3797) tipc_connect (net/tipc/socket.c:2570) __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)
Title		tipc: fix divide-by-zero in tipc_sk_filter_connect()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2754e7b3d64748643df867d1ea6fec522914b635 https://git.kernel.org/stable/c/338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3 https://git.kernel.org/stable/c/3bc9998041076ee05d3f312a22cee6b2ca35527f https://git.kernel.org/stable/c/579956f9f297eb1b6a5d24de313f3acccee1f9d5 https://git.kernel.org/stable/c/600feb0a66a98c6b7f6f02b5f3612e75f9b8540f https://git.kernel.org/stable/c/6c5a9baa15de240e747263aba435a0951da8d8d2 https://git.kernel.org/stable/c/a360d3815aae1f00dd71b7714a846482e85cc1f7 https://git.kernel.org/stable/c/c2ebfbe63deb7bfd4dc2532bae62a7ed67713272