CVE-2026-98550

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

Commit 48a5fe38772b ("tipc: fix bc_ackers underflow on duplicate

GRP_ACK_MSG") rejected duplicate/stale ACKs in tipc_group_proto_rcv()

by returning early when less_eq(acked, m->bc_acked).

However, that check remains incomplete in two ways:

1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast

ACKs were not requested, or after all expected members have already

acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked

passes less_eq() and unconditionally decrements grp->bc_ackers.

Because bc_ackers is a u16, this wraps to 65535, causing

tipc_group_bc_cong() to permanently report congestion and blocking

all future group broadcasts on the socket.

2. During an active broadcast round (grp->bc_ackers > 0), the sender

transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers

increment th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References