A peer in the TIPC network can send a PUBLICATION item with the service range bounds inverted (lower greater than upper). The Linux kernel’s tipc_update_nametbl function inserts this binding into the name table without checking bound order, so the entry is placed at the far end of the red‑black tree where it can never be matched by a lookup or withdrawal. Because the binding remains in memory for the lifetime of the namespace and there is no per‑peer publication limit for remote nodes, an attacker can cause unbounded memory growth and leak sensitive data. The flaw does not require local code execution; it is fully exploitable over the network by sending crafted TIPC messages.

All Linux kernel releases that contain the unpatched TIPC implementation are affected. The flaw was addressed in the kernel source after the commits referenced in the advisory; any kernel build that predates those commits inherits the vulnerability. The affected vendor is the Linux kernel project.

The CVSS score is 7.5, indicating high severity, but the EPSS score of <1% indicates a low exploitation probability. The lack of input validation combined with a remote, network‑gated attack path and the absence of any per‑peer cap means the vulnerability can be exploited by any untrusted peer, although the low EPSS suggests a limited threat in typical environments. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can trigger the weakness by sending a single crafted PUBLICATION packet through a TIPC channel, leading to memory exhaustion or leakage. The risk is moderate for systems that use TIPC for inter‑node communication and cannot fully trust all peers.