A user-space application that interacts with the TIPC protocol can cause the kernel to panic by triggering a copy of a buffer whose length is computed using an integer type cast. The overflow occurs in tipc_recvmsg() and tipc_recvstream() where a size_t value is cast to an int, resulting in a negative value that is later promoted back to size_t, causing a kernel warning that escalates to a panic. The failure can lead to a complete loss of system availability, as the kernel reboots or stops accepting further operations.

All Linux kernel distributions that have the TIPC subsystem enabled are potentially vulnerable. The issue is present in the kernel source regardless of distribution vendor; the fix is applied in upstream kernel changes. No specific release or patch level is cited in the advisory. System administrators should verify that their running kernel does not use the unpatched TIPC code.

The CVSS score of 6.5 indicates a medium severity attack. The EPSS score is < 1%, implying a very low likelihood of exploitation. The likely attack vector is local, as a user-space program can invoke io_uring with an oversized buffer to trigger the overflow. The vulnerability is not listed in CISA KEV, meaning it may not yet have known public exploits, but the potential impact remains significant.