The Linux kernel's TIPC protocol had a vulnerability (CVE-2026-64450) involving an out-of-bounds read in broadcast Gap ACK blocks. The function tipc_get_gap_ack_blks() verified the length field of a Gap ACK record only against internal counts but did not check if the record fit within the message data area. While the unicast path bounds the record size, the broadcast path did not, leading to kmemdup() copying more bytes than the buffer contained. An attacker-controlled broadcast STATE_MSG with a large len field and counts could trigger this, causing a slab-out-of-bounds read detected by KASAN. The patch adds bounds checking in the broadcast path to discard oversized records and prevent processing them.

This vulnerability results in an out-of-bounds read in kernel memory during processing of malformed broadcast messages in the TIPC protocol. The out-of-bounds read can cause kernel memory corruption or crashes detected by KASAN, potentially leading to denial of service. There is no evidence of code execution or privilege escalation from the provided data. The impact is limited to kernel stability and memory safety.

A fix is available that adds proper bounds checking in the broadcast message processing path of the TIPC protocol to discard malformed Gap ACK records that do not fit the message data area. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, upgrading to a fixed kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; check the vendor advisory for the exact fixed kernel versions and apply updates accordingly.