CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK

In the Linux kernel, the following vulnerability has been resolved:

tipc: prevent sntunacked underflow on CONNACK

tipcskconnprotorcv() subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages actually outstanding:

tsk->sntunacked -= msgconnack(hdr);

msgconnack() is read straight from a received CONNMANAGER/CONNACK message. If the ack count is larger than sntunacked, the subtraction wraps to a near-maximum value, leaving tskconncong() permanently true and starving the connection of further transmits.

Validate the ACK count at the start of the CONNACK block and drop the message if it acknowledges more messages than are outstanding. A peer (or, for a local connection, the connected peer socket) can otherwise wedge a TIPC connection's send side by sending an oversized connection ack.