The Linux kernel’s TIPC module processes group acknowledgment messages without fully validating their sequence numbers and the number of expected acknowledgers. A malformed GRP_ACK_MSG can decrement an unsigned 16‑bit counter, bc_ackers, from zero to 65535, which the kernel interprets as permanent congestion, blocking all future broadcasts in that group – a classic integer underflow flaw (CWE‑191). Because the module also accepts ACK values that are not the current broadcast sequence number, an attacker can cause the counter to be decremented twice in a single round, prematurely clearing bc_ackers or underflowing it. The result is a denial of service that prevents any successful broadcasts on compromised TIPC sockets, but it does not provide broader system compromise.

Any Linux kernel deployment that compiles and loads the TIPC networking stack and has not yet incorporated the fix commit 48a5fe38772b is potentially vulnerable. All kernel releases older than that commit, regardless of minor or patch level, contain the flaw. The vulnerability applies to systems that accept TIPC traffic on network interfaces, whether local or remote.

The CVSS score of 7.5 reflects a high severity. The EPSS score of <1% indicates a low probability of current exploitation. It is not listed in the CISA KEV catalog, suggesting the flaw has limited or no known active exploitation. The likely attack vector requires an adversary to send crafted GRP_ACK_MSG packets to a TIPC endpoint, which typically means remote network access to a TIPC‑enabled interface – this statement is inferred from the nature of the protocol. Successful exploitation results in a Denial‑of‑Service condition by permanently marking the socket congested.