CVE-2026-64450 is an out-of-bounds read vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) protocol. The vulnerability arises because the function tipc_get_gap_ack_blks() verifies the consistency of the Gap ACK blocks record length with its counts but does not ensure the record fits within the message data area. While the unicast caller bounds the record size, the broadcast caller discards the returned size, leading to an attacker-controlled copy length in tipc_link_advance_transmq(). This allows a TIPC neighbor to trigger an out-of-bounds read by sending a specially crafted broadcast STATE_MSG with a short data area carrying a malformed Gap ACK record. The vulnerability affects Linux kernel versions prior to the patched releases indicated in the Ubuntu advisories. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality impact, no integrity impact, and high availability impact.

An attacker capable of sending broadcast TIPC messages can cause an out-of-bounds read in the kernel, potentially leading to denial of service (system crash) or information disclosure. The CVSS score of 9.1 reflects a critical impact on confidentiality and availability without requiring privileges or user interaction. There are no known exploits in the wild at this time.

A patch is available and should be applied by updating to the fixed Linux kernel versions as specified in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigations are indicated by the vendor.