CVE-2026-43411

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tipc: fix divide-by-zero in tipc_sk_filter_connect()<br /> <br /> A user can set conn_timeout to any value via<br /> setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a<br /> SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in<br /> tipc_sk_filter_connect() executes:<br /> <br /> delay %= (tsk-&gt;conn_timeout / 4);<br /> <br /> If conn_timeout is in the range [0, 3], the integer division yields 0,<br /> and the modulo operation triggers a divide-by-zero exception, causing a<br /> kernel oops/panic.<br /> <br /> Fix this by clamping conn_timeout to a minimum of 4 at the point of use<br /> in tipc_sk_filter_connect().<br /> <br /> Oops: divide error: 0000 [#1] SMP KASAN NOPTI<br /> CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+<br /> RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)<br /> Call Trace:<br /> tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)<br /> __release_sock (include/net/sock.h:1185 net/core/sock.c:3213)<br /> release_sock (net/core/sock.c:3797)<br /> tipc_connect (net/tipc/socket.c:2570)<br /> __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)