CVE-2026-43411 tipc: fix divide-by-zero in tipc_sk_filter_connect()
A local attacker can cause a kernel panic by setting a low TIPC connection timeout, leading to a divide-by-zero error during connection retries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43411?
CVE-2026-43411 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix divide-by-zero in tipc_sk_filter_connect()
A user can set conn_timeout to any value via setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in tipc_sk_filter_connect() executes:
delay %= (tsk->conn_timeout / 4);
If conn_timeout is in the range [0, 3], the integer division yields 0, and the modulo operation triggers a divide-by-zero exception, causing a kernel oops/panic.
Fix this by clamping conn_timeout to a minimum of 4 at the point of use in tipc_sk_filter_connect().
Oops: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+ RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362) Call Trace: tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406) __release_sock (include/net/sock.h:1185 net/core/sock.c:3213) release_sock (net/core/sock.c:3797) tipc_connect (net/tipc/socket.c:2570) __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)
Weakness: CWE-369
Which versions are affected by CVE-2026-43411?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43411?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43411 being exploited?
There is no known exploitation of CVE-2026-43411 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43411, DEBIAN-CVE-2026-43411, GHSA-5396-3j5p-9gg2, ROOT-OS-DEBIAN-11-CVE-2026-43411, ROOT-OS-UBUNTU-2204-CVE-2026-43411, ROOT-OS-UBUNTU-2404-CVE-2026-43411 and 1 more.