CVE-2026-64450

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the Transparent Inter-Process Communication (TIPC) implementation when handling broadcast Gap ACK blocks. The function tipc get gap ack blks() verifies if the record length is consistent with the ugack cnt and bgack cnt counts but fails to check if the record fits within the message data area, msg data sz(). While the unicast path correctly bounds this, the broadcast caller tipc bcast sync rcv() discards the returned size. This allows tipc link advance transmq() to copy data from the receive socket buffer (skb) using an attacker-controlled count via kmemdup(), leading to a slab-out-of-bounds read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.