In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow… (CVE-2026-98550)

The Linux kernel's TIPC (Transparent Inter-Process Communication) protocol had a flaw in handling GRP_ACK_MSG messages. Specifically, when the bc_ackers counter was zero, unexpected ACK messages with acked values greater than the member's bc_acked would decrement bc_ackers, causing it to wrap around from 0 to 65535. This leads to permanent congestion signaling and blocks future broadcasts. Additionally, during active broadcast rounds, the protocol allowed a 2-sequence gap in acknowledgment values, enabling duplicate or stale ACKs to decrement bc_ackers multiple times, potentially clearing or underflowing it prematurely. The fix involves dropping GRP_ACK_MSGs immediately if bc_ackers is zero and requiring that only the current broadcast sequence number (grp->bc_snd_nxt) be acknowledged once per round, rejecting duplicates and invalid ACKs.

If exploited, this vulnerability causes the bc_ackers counter to underflow, resulting in the TIPC protocol permanently reporting congestion and blocking all future group broadcasts on the affected socket. This effectively disrupts group communication over TIPC, potentially causing denial of service for applications relying on this communication channel.

A fix for this vulnerability has been implemented in the Linux kernel. It drops invalid GRP_ACK_MSG messages when bc_ackers is zero and enforces strict validation of acknowledgment sequence numbers to prevent underflow. Users should apply the official kernel update that includes this patch once available. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.