CVE-2026-31662 tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
An attacker can cause a denial of service in the Linux kernel TIPC module by sending duplicate group ACK messages, leading to a counter underflow that blocks broadcasts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31662?
CVE-2026-31662 is a high-severity vulnerability in Linux kernel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round.
Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated.
Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path.
Which versions are affected by CVE-2026-31662?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31662?
Apply the vendor's patch.
Is CVE-2026-31662 being exploited?
There is no known exploitation of CVE-2026-31662 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83798, BELL-CVE-2026-31662, DEBIAN-CVE-2026-31662, GHSA-895h-4xx6-r95p, ROOT-OS-DEBIAN-11-CVE-2026-31662, ROOT-OS-DEBIAN-12-CVE-2026-31662 and 4 more.