In the Linux kernel’s TIPC implementation, a broadcast STATE_MSG can contain a malicious Gap ACK block. The code verifies only the internal length field, not whether the block fits within the received message. An attacker can craft a record with a large length that exceeds the actual data size, causing the kernel to copy >1 KB of memory out of the skbuff. This results in a KASAN error and can lead to the disclosure of kernel data to the attacker. The vulnerability is an instance of improper input validation that enables an out-of-bounds read (CWE-125).

All Linux kernel builds that include the vulnerable tipc module prior to the recent commit are affected. The exact version range is not specified in the advisory, but any kernel containing the pre-fix tipc code is impacted, regardless of distribution or patch level.

The EPSS score indicates a very low exploitation probability (< 1 %). The vulnerability is not currently listed in the CISA KEV catalog. An attacker must be able to send specially crafted TIPC broadcast packets to a TIPC-enabled host, which could be achieved over a local or network interface that accepts TIPC traffic. Once an exploitation attempt succeeds, it triggers a KASAN out-of-bounds error and may result in a kernel fault, potentially exposing kernel memory. The lack of a readily available public exploit and low EPSS reduce the urgency of immediate remediation. The primary risk is denial of service if the kernel fault is triggered by an adversary controlling TIPC state messages.