CVE-2026-43411 - Vulnerability Details

- tipc: fix divide-by-zero in tipc_sk_filter_connect()

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix divide-by-zero in tipc_sk_filter_connect()

A user can set conn_timeout to any value via
setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a
SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in
tipc_sk_filter_connect() executes:

delay %= (tsk->conn_timeout / 4);

If conn_timeout is in the range [0, 3], the integer division yields 0,
and the modulo operation triggers a divide-by-zero exception, causing a
kernel oops/panic.

Fix this by clamping conn_timeout to a minimum of 4 at the point of use
in tipc_sk_filter_connect().

Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+
RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)
Call Trace:
tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)
__release_sock (include/net/sock.h:1185 net/core/sock.c:3213)
release_sock (net/core/sock.c:3797)
tipc_connect (net/tipc/socket.c:2570)
__sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)

Published: 2026-05-08

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is an integer division by zero in the tipc_sk_filter_connect function of the Linux kernel's TIPC socket module. When the socket option TIPC_CONN_TIMEOUT is set to any value from 0 to 3 via setsockopt, the retry path for a rejected SYN calculates delay %= (tsk->conn_timeout / 4);. Since the division yields zero, the modulo operation triggers a divide‑by‑zero exception, causing a kernel oops and potentially a panic. This results in a denial of service by crashing the kernel.

Affected Systems

The weakness affects all Linux kernel builds that include the TIPC socket module and have not applied the fix that clamps conn_timeout to a minimum of four. No specific distribution or version is singled out; any kernel incorporating the current TIPC implementation before the patch is vulnerable.

Risk and Exploitability

The CVSS score is 7.0, indicating high severity because a kernel crash can bring a system down. EPSS is not available, and the issue is not in CISA's KEV catalog. Attackers can trigger the crash by creating a local TIPC socket and calling setsockopt to set TIPC_CONN_TIMEOUT to a low value. The likely attack vector is local, as it requires only execution privileges to create a socket, which does not require network connectivity. Based on the description, it is inferred that no network‑level privilege escalation is needed to exploit the flaw; a local user can induce the crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 600feb0a66a98c6b7f6f02b5f3612e75f9b8540f
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 3bc9998041076ee05d3f312a22cee6b2ca35527f
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 579956f9f297eb1b6a5d24de313f3acccee1f9d5
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< a360d3815aae1f00dd71b7714a846482e85cc1f7
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< c2ebfbe63deb7bfd4dc2532bae62a7ed67713272
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 2754e7b3d64748643df867d1ea6fec522914b635
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3
`6787927475e52f6933e3affce365dabb2aa2fadf`	affected	< 6c5a9baa15de240e747263aba435a0951da8d8d2

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.19`	unaffected	≤ 6.18.*
`6.19.9`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6787927475e52f6933e3affce365dabb2aa2fadf,600feb0a66a98c6b7f6f02b5f3612e75f9b8540f)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,3bc9998041076ee05d3f312a22cee6b2ca35527f)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,579956f9f297eb1b6a5d24de313f3acccee1f9d5)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,a360d3815aae1f00dd71b7714a846482e85cc1f7)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,c2ebfbe63deb7bfd4dc2532bae62a7ed67713272)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,2754e7b3d64748643df867d1ea6fec522914b635)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3)`	affected	code_commit	—
`[6787927475e52f6933e3affce365dabb2aa2fadf,6c5a9baa15de240e747263aba435a0951da8d8d2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.20`	affected	semver	—
`[0,4.20)`	unaffected	semver	—
`[5.10.253,5.10.*]`	unaffected	semver	—
`[5.15.203,5.15.*]`	unaffected	semver	—
`[6.1.167,6.1.*]`	unaffected	semver	—
`[6.6.130,6.6.*]`	unaffected	semver	—
`[6.12.78,6.12.*]`	unaffected	semver	—
`[6.18.19,6.18.*]`	unaffected	semver	—
`[6.19.9,6.19.*]`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the patch that clamps conn_timeout to a minimum of four at tipc_sk_filter_connect().
If an immediate upgrade is not possible, avoid setting TIPC_CONN_TIMEOUT to a value less than four by ensuring applications use the default or a safe timeout value or by adding a check in client code before calling setsockopt.
Disabling or removing the TIPC kernel module is a viable temporary measure if TIPC functionality is not required.

Generated by OpenCVE AI on May 9, 2026 at 04:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2754e7b3d64748643df867d1ea6fec522914b635
https://git.kernel.org/stable/c/338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3
https://git.kernel.org/stable/c/3bc9998041076ee05d3f312a22cee6b2ca35527f
https://git.kernel.org/stable/c/579956f9f297eb1b6a5d24de313f3acccee1f9d5
https://git.kernel.org/stable/c/600feb0a66a98c6b7f6f02b5f3612e75f9b8540f
https://git.kernel.org/stable/c/6c5a9baa15de240e747263aba435a0951da8d8d2
https://git.kernel.org/stable/c/a360d3815aae1f00dd71b7714a846482e85cc1f7
https://git.kernel.org/stable/c/c2ebfbe63deb7bfd4dc2532bae62a7ed67713272
https://lore.kernel.org/linux-cve-announce/2026050843-CVE-2026-43411-6074@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43411
https://www.cve.org/CVERecord?id=CVE-2026-43411

History

Sat, 09 May 2026 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-369

Sat, 09 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://lore.kernel.org/linux-cve-announce/2026050843-CVE-2026-43411-6074@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43411 https://www.cve.org/CVERecord?id=CVE-2026-43411
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 08 May 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-369

Fri, 08 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: fix divide-by-zero in tipc_sk_filter_connect() A user can set conn_timeout to any value via setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in tipc_sk_filter_connect() executes: delay %= (tsk->conn_timeout / 4); If conn_timeout is in the range [0, 3], the integer division yields 0, and the modulo operation triggers a divide-by-zero exception, causing a kernel oops/panic. Fix this by clamping conn_timeout to a minimum of 4 at the point of use in tipc_sk_filter_connect(). Oops: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+ RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362) Call Trace: tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406) __release_sock (include/net/sock.h:1185 net/core/sock.c:3213) release_sock (net/core/sock.c:3797) tipc_connect (net/tipc/socket.c:2570) __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)
Title		tipc: fix divide-by-zero in tipc_sk_filter_connect()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2754e7b3d64748643df867d1ea6fec522914b635 https://git.kernel.org/stable/c/338c5edeb6ae3f12a4b84dff9d71f6f7f8c202c3 https://git.kernel.org/stable/c/3bc9998041076ee05d3f312a22cee6b2ca35527f https://git.kernel.org/stable/c/579956f9f297eb1b6a5d24de313f3acccee1f9d5 https://git.kernel.org/stable/c/600feb0a66a98c6b7f6f02b5f3612e75f9b8540f https://git.kernel.org/stable/c/6c5a9baa15de240e747263aba435a0951da8d8d2 https://git.kernel.org/stable/c/a360d3815aae1f00dd71b7714a846482e85cc1f7 https://git.kernel.org/stable/c/c2ebfbe63deb7bfd4dc2532bae62a7ed67713272

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-08T14:21:49.543Z

Updated: 2026-05-08T14:21:49.543Z

Reserved: 2026-05-01T14:12:56.008Z

Link: CVE-2026-43411

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-05-08T15:16:52.880

Modified: 2026-05-08T15:16:52.880

Link: CVE-2026-43411

Redhat

Severity : Moderate

Publid Date: 2026-05-08T00:00:00Z

Links: CVE-2026-43411 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-09T04:45:26Z

Weaknesses

CWE-1284

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object