The Linux kernel TIPC subsystem can accept malformed or unexpected group acknowledgment messages (GRP_ACK_MSG) and incorrectly decrement an unsigned 16‑bit counter, bc_ackers. When this counter underflows, it wraps to 65535, causing tipc_group_bc_cong() to report permanent congestion and permanently blocking all future broadcasts on the socket. This results in a denial‑of‑service for applications that rely on TIPC group broadcasts.

The vulnerability affects any Linux kernel that implements the TIPC stack and has not incorporated commit 48a5fe38772b. No specific kernel release numbers are listed, so all kernels lacking that patch are potentially vulnerable. The exploit requires an attacker capable of injecting TIPC GRP_ACK_MSG packets toward the target host.

The CVSS score is not provided, the EPSS score is unavailable, and the vulnerability is not in CISA’s KEV catalog, indicating no documented exploitation yet. Exploitation requires the ability to send TIPC GRP_ACK_MSG packets to the target machine, implying either local or remote network access to the vulnerable host. The bug does not provide code execution; it purely causes service disruption.