CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix u16 MTU truncation in media and bearer MTU validation
Both TIPCNLMEDIASET and TIPCNLBEARERSET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceeding U16MAX (65535), it passes validation but is silently truncated when assigned to u16 fields l->mtu and l->advertisedmtu in tipclinkcreate(). Values like 65536 (0x10000) truncate to 0, causing a division by zero in tipclinksetqueuelimits() which computes TIPCMAXPUBL / (l->mtu / ITEMSIZE). Other overflowing values (e.g. 65537-131071) produce small incorrect MTU values, resulting in link malfunction behaviors.
Crash stack (triggered as unprivileged user via user namespace):
tipclinksetqueuelimits net/tipc/link.c:2531 tipclinkcreate net/tipc/link.c:520 tipcnodecheckdest net/tipc/node.c:1279 tipcdiscrcv net/tipc/discover.c:252 tipcrcv net/tipc/node.c:2129 tipcudprecv net/tipc/udpmedia.c:392
Two independent paths lack the upper bound check: 1. tipcudpmtubad() -- called from tipcnlmediaset() (MEDIASET) 2. inline check in tipcnlbearerset() at bearer.c:1160 (BEARERSET)
Fix both by rejecting MTU values above U16MAX.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fix to both MTU netlink paths by enforcing an upper bound check: in __tipc_nl_bearer_set() (net/tipc/bearer.c:1160, BEARER_SET) and in __tipc_nl_media_set() (MEDIA_SET), reject MTU values greater than U16_MAX (65535) instead of only validating a minimum bound. This prevents u16 truncation and the resulting division-by-zero in tipc_link_set_queue_limits().
Linux kernel TIPC (tipc) MTU validation (TIPC_NL_MEDIA_SET / TIPC_NL_BEARER_SET) = Reject MTU values above U16_MAX (65535) - Operational
After applying the kernel TIPC MTU validation fix, restart/refresh any affected TIPC links (e.g., recreate TIPC links created via tipc_link_create and/or media/bearer netlink configuration paths) to ensure previously truncated MTU values are replaced with valid values within 0..65535.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68297?
CVE-2026-68297 has a risk score of 52, indicating a notable vulnerability that can be exploited.
What systems are affected by CVE-2026-68297?
CVE-2026-68297 affects the Linux kernel implementations utilizing TIPC features.
How do I fix CVE-2026-68297?
To fix CVE-2026-68297, update your Linux kernel to the latest version where the vulnerability has been patched.
What type of vulnerability is CVE-2026-68297?
CVE-2026-68297 is a truncation vulnerability related to MTU validation in the TIPC protocol.
What is TIPC in relation to CVE-2026-68297?
TIPC stands for Transparent Inter-Process Communication, which is a protocol affected by the vulnerability CVE-2026-68297.