{"id":"CVE-2026-74281","summary":"tipc: reject inverted service ranges from peer bindings","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject inverted service ranges from peer bindings\n\ntipc_update_nametbl() inserts a binding advertised by a peer node using\nthe lower and upper service-range bounds taken directly from the wire,\nwithout checking that lower \u003c= upper. The local bind path validates the\nordering (tipc_uaddr_valid()), but the name-distribution path does not.\n\nA binding with lower \u003e upper is inserted at the far end of the\nservice-range rbtree (keyed on lower) where no lookup or withdrawal can\never match it (service_range_foreach_match() requires sr-\u003elower \u003c= end).\nThe publication, its service_range node and the augmented rbtree entry\nare then leaked for the lifetime of the namespace, and there is no\nper-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.\n\nReject inverted ranges in the network path as well. A peer node can\notherwise leak unbounded binding-table memory by sending PUBLICATION\nitems with lower \u003e upper.","modified":"2026-08-18T03:56:45.861051605Z","published":"2026-08-15T05:57:51.423Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74281.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153"},{"type":"WEB","url":"https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676"},{"type":"WEB","url":"https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74281.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74281"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"37922ea4a3105176357c8d565a9d982c4a08714a"},{"fixed":"cd1955f81bd8ebeef51b324989ac871ad1947fb6"},{"fixed":"f683200b83a0085d4e11abea8c1fdd9fdfb95b0b"},{"fixed":"f1715d92ee3095d9215b493a8603a81f646fcf61"},{"fixed":"581ef56e5c34d475056ce086dc2ba0e872ba6857"},{"fixed":"7e401233f9bb74a626e70698d0d62f3a94ac0676"},{"fixed":"973bf0ed896b9898668dbadb82ed849d7d573010"},{"fixed":"2afb648f7b99216c687db1f89739c995e1144153"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74281.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74281.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}