CVE-2026-31662: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31662 is an integer underflow (wraparound) vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) group messaging subsystem. The flaw exists in the GRP_ACK_MSG handler within tipc_group_proto_rcv(), where the bc_ackers counter (a 16-bit unsigned integer) is decremented on every inbound group ACK, including duplicates, causing it to wrap to 65535 and triggering a persistent denial-of-service condition. It affects Linux kernel versions from 4.15.1 through multiple stable branches up to 6.19.x. The vulnerability was disclosed on April 24, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-191 (Integer Underflow / Wrap or Wraparound). In tipc_group_proto_rcv(), the bc_ackers field — a u16 — is decremented each time a GRP_ACK_MSG is received, without first checking whether the sending member has already acknowledged the current broadcast round. When a duplicate ACK arrives after the final legitimate ACK has already decremented bc_ackers to zero, the counter wraps around to 65535. This causes tipc_group_bc_cong() to perpetually report congestion, blocking all subsequent group broadcasts on the affected socket until the TIPC group is torn down and recreated. The fix makes duplicate/stale ACK handling idempotent by ignoring such messages before modifying bc_acked or bc_ackers (GitHub Advisory, Kernel Patch).

Successful exploitation results in a denial-of-service condition affecting TIPC group broadcast communications. Once the bc_ackers counter wraps, all subsequent group broadcasts on the affected socket are blocked indefinitely, disrupting inter-process communication until the TIPC group is recreated. There is no confidentiality or integrity impact; the vulnerability is limited to availability, affecting systems relying on TIPC for inter-node or inter-process messaging (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is network-accessible (AV:N), requires no authentication or user interaction, and has low attack complexity, making it theoretically straightforward to trigger by sending duplicate GRP_ACK_MSG packets to a TIPC group socket. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify target systems running a vulnerable Linux kernel version (4.15.1 through 5.10.252, 5.11–5.15.202, 5.16–6.1.168, 6.2–6.6.134, 6.7–6.12.81, 6.13–6.18.22, or 6.19.x before 6.19.13) with TIPC enabled and a TIPC group socket in use.
2. Join or spoof TIPC group: Gain network access to the TIPC cluster (TIPC operates over a local network or bearer layer) and either join the target TIPC group as a member or spoof a member's identity.
3. Send legitimate ACK: Allow or observe a legitimate GRP_ACK_MSG to be sent for the current broadcast round, decrementing bc_ackers to zero.
4. Send duplicate ACK: Transmit an additional GRP_ACK_MSG from the same member for the same broadcast round, causing bc_ackers (a u16) to underflow and wrap to 65535.
5. Trigger DoS: With bc_ackers wrapped, tipc_group_bc_cong() continuously reports congestion, blocking all further group broadcasts on the affected socket and disrupting TIPC-dependent inter-process communication until the group is recreated (GitHub Advisory, Feedly).

• Network: Unexpected duplicate GRP_ACK_MSG TIPC packets from the same source member for the same broadcast sequence number; anomalous TIPC control traffic volume on the network bearer interface.
• Logs: Kernel log messages (via dmesg or /var/log/kern.log) indicating TIPC congestion or group broadcast failures; repeated TIPC group congestion events without corresponding traffic load.
• Process/Application: Applications using TIPC group sockets hanging or timing out on broadcast send operations; TIPC group sockets stuck in a congested state that does not resolve without group recreation.
• System: Unexpected TIPC group teardown and recreation events logged by TIPC-dependent services (GitHub Advisory, Feedly).

Apply the upstream kernel patches available for all affected stable branches: upgrade to 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0 and later. Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:21834-1, SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, SUSE-SU-2026:2238-1), Amazon Linux (ALAS2KERNEL-5.10-2026-118), and openSUSE. As a temporary workaround where patching is not immediately possible, restrict network access to TIPC group messaging functionality and monitor for duplicate acknowledgment messages (GitHub Advisory, Red Hat Bugzilla, SUSE Advisory, Amazon Linux).

The vulnerability received routine coverage from Linux distribution vendors including SUSE, openSUSE, Amazon Linux, and Debian, all of whom issued kernel update advisories. Tenable published multiple Nessus detection plugins (e.g., 318102, 318240, 319659) and pipeline issue trackers for the vulnerability. No notable independent researcher commentary or significant social media discussion beyond standard vulnerability tracking has been observed (SUSE Advisory, Amazon Linux).