A critical out-of-bounds read vulnerability in the Linux kernel TIPC subsystem could allow an unauthenticated remote attacker to compromise system memory and cause service disruption.

The vulnerability exists in the TIPC (Transparent Inter-Process Communication) broadcast handling logic. An unauthenticated attacker can send a crafted broadcast message that fails to validate the size of Gap ACK blocks against the actual message data, resulting in an out-of-bounds read via kmemdup.

The flaw carries a CVSS score of 9.1, reflecting its critical potential for remote exploitation without user interaction. Successful exploitation may lead to the disclosure of sensitive kernel memory contents or cause a system crash, resulting in significant service downtime and potential exposure of proprietary data residing in the kernel address space.

Immediate Action: Update the Linux kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, or later, depending on the current stable branch in use.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or crashes and analyze network traffic for malformed TIPC protocol messages.

Compensating Controls: If patching is not immediately feasible, disable the TIPC module if it is not required for system operations to eliminate the attack surface.

Public Exploit Available: No

Given the critical nature of this kernel-level vulnerability and the lack of required authentication for exploitation, system administrators should prioritize patching as part of the next scheduled maintenance cycle. Ensure that all downstream Linux distributions are updated as soon as their respective maintainers release the relevant kernel packages.