CVE-2022-0435: Linux kernel TIPC stack overflow via oversized domain member node count

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and high EPSS, though exploitation requires access to the TIPC network and no KEV listing.

What it is

A stack overflow exists in the Linux kernel TIPC protocol handling when a packet declares more than the 64 allowed domain member nodes. The out-of-bounds write can crash the system or potentially allow privilege escalation for an attacker with access to the TIPC network.

Impact

An attacker can crash the affected system and may escalate privileges if they can reach the TIPC network.

Attack surface

The flaw is reached over the network via TIPC packets; the CVSS vector indicates network access with low privileges required and no user interaction.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.68 (99th percentile), and references include an exploit-tagged advisory, indicating public exploit material exists.

What to do

• Apply the kernel patch referenced in the Red Hat Bugzilla and Openwall advisories.
• Update affected Red Hat Enterprise Linux, oVirt, Fedora and NetApp products to fixed versions.
• Restrict or disable TIPC on hosts that do not require it, and firewall TIPC traffic to trusted nodes.
• Monitor vendor advisories for updated builds covering your specific product and kernel version.

Detection

• Monitor kernel logs for TIPC-related stack traces, panics or oops messages.
• Alert on unexpected TIPC traffic, especially packets with unusually high domain member node counts.
• Track host reboots or crashes correlated with TIPC activity on systems where TIPC is enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.