CVE-2026-64450

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tipc: fix out-of-bounds read in broadcast Gap ACK blocks<br /> <br /> A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its<br /> data area. tipc_get_gap_ack_blks() only verifies that the record&amp;#39;s len<br /> field is self-consistent with its ugack_cnt/bgack_cnt counts<br /> (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check<br /> that the record actually fits in the message data area, msg_data_sz().<br /> <br /> The unicast caller tipc_link_proto_rcv() bounds it ("if (glen &gt; dlen)<br /> break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the<br /> returned size, so tipc_link_advance_transmq() copies the record off the<br /> receive skb with an attacker-controlled count:<br /> <br /> this_ga = kmemdup(ga, struct_size(ga, gacks, ga-&gt;bgack_cnt),<br /> GFP_ATOMIC);<br /> <br /> A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one<br /> ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its<br /> data area is short, carrying a Gap ACK record with len = 0x400,<br /> bgack_cnt = 0xff and ugack_cnt = 0. len then equals<br /> struct_size(p, gacks, 255), so the consistency check passes and ga is<br /> non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out<br /> of the much smaller skb:<br /> <br /> BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60<br /> Read of size 1024 at addr ffff0000c7030d38 by task poc864/69<br /> Call trace:<br /> kmemdup_noprof+0x48/0x60<br /> tipc_link_advance_transmq+0x86c/0xb80<br /> tipc_link_bc_ack_rcv+0x19c/0x1e0<br /> tipc_bcast_sync_rcv+0x1c4/0x2c4<br /> tipc_rcv+0x85c/0x1340<br /> tipc_l2_rcv_msg+0xac/0x104<br /> The buggy address belongs to the object at ffff0000c7030d00<br /> which belongs to the cache skbuff_small_head of size 704<br /> The buggy address is located 56 bytes inside of<br /> allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)<br /> <br /> The copied-out bytes are subsequently consumed as gap/ack values, but<br /> the read is already out of bounds at the kmemdup() regardless of how<br /> they are used.<br /> <br /> The unicast STATE path drops such a message: "if (glen &gt; dlen) break;"<br /> skips the rest of STATE_MSG handling and the skb is freed. Make the<br /> broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record<br /> against msg_data_sz() and, when it does not fit, reports it back through<br /> tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than<br /> processed. ga is not cleared on this path: ga == NULL already means<br /> "legacy peer without Selective ACK", a distinct legitimate state.