CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect()
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix divide-by-zero in tipcskfilterconnect()
A user can set conntimeout to any value via setsockopt(TIPCCONNTIMEOUT), including values less than 4. When a SYN is rejected with TIPCERROVERLOAD and the retry path in tipcskfilterconnect() executes:
delay %= (tsk->conntimeout / 4);
If conntimeout is in the range [0, 3], the integer division yields 0, and the modulo operation triggers a divide-by-zero exception, causing a kernel oops/panic.
Fix this by clamping conntimeout to a minimum of 4 at the point of use in tipcskfilterconnect().
Oops: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+ RIP: 0010:tipcskfilterrcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362) Call Trace: tipcskbacklogrcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406) releasesock (include/net/sock.h:1185 net/core/sock.c:3213) releasesock (net/core/sock.c:3797) tipcconnect (net/tipc/socket.c:2570) sysconnect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)
Affected Software
Remediation
Event History
Frequently Asked Questions
What access and conditions are required to trigger the crash?
An attacker needs local access and the ability to use TIPC sockets. They must set TIPC_CONN_TIMEOUT to a value from 0 through 3, then cause a SYN rejection with TIPC_ERR_OVERLOAD so that the connection retry path runs.
What is the practical impact of successful exploitation?
The modulo operation uses a zero divisor and triggers a kernel divide-by-zero exception. This can cause a kernel oops or panic, resulting in a local denial of service.
What can be done if patching cannot happen immediately?
Prevent untrusted local users or workloads from creating and configuring TIPC sockets, particularly from setting TIPC_CONN_TIMEOUT below 4. The vulnerable condition depends on those low timeout values and an overloaded SYN rejection.
How does the fix prevent the issue?
The fix clamps conn_timeout to a minimum value of 4 in tipc_sk_filter_connect(). This ensures that conn_timeout / 4 cannot evaluate to zero before it is used as the modulo divisor.