The flaw resides in the TIPC socket implementation, where receiving a CONN_ACK message causes the kernel to subtract an ack count supplied by the peer from the send counter snt_unacked without verifying that the count does not exceed the number of messages actually outstanding. Because snt_unacked is an unsigned 16‑bit integer, providing a value larger than the counter causes an underflow, wrapping the value to a high number that permanently sets the congestion flag. The result is that no further data can be transmitted on the affected TIPC connection, leading to a denial of service for any application relying on that communication channel. The weakness is an integer underflow (CWE‑191).

The vulnerability affects Linux kernel code prior to the implementation of acknowledgment validation found in the listed commit references. Current kernel releases that include the added guard are not affected. Therefore, only systems running older kernel versions lacking this patch are at risk, regardless of distribution or hardware configuration.

The EPSS score is reported as <1 %, which indicates a very low probability of exploitation. The CVSS score is 7.5, indicating a high severity, and the vulnerability is not listed in CISA KEV, suggesting limited documented exploitation activity. The likely attack vector is a crafted CONN_ACK message sent over a TIPC network; this could originate from a remote peer or a local process connected to the same TIPC socket. No elevated privileges are required. If an attacker succeeds, the send‑side starvation of the TIPC connection can disrupt dependent services. Because the vulnerability is not widely exploited, the overall risk remains moderate, but the impact of a successful exploit is clear.