CVE-2026-68289

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix integer overflow in tipcrecvmsg() and tipcrecvstream()

In tipc_recvmsg(), the copy length is computed as:

copy = min_t(int, dlen - offset, buflen);

buflen is sizet but mint(int, ...) casts it to int. When buflen exceeds INTMAX (e.g. 0xFFFFFFFF via iouring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simplecopytoiter() where int-to-sizet promotion makes it SIZEMAX, triggering a WARNON. tipc_recvstream() has the same pattern.

Kernel panic - not syncing: kernel: paniconwarn set ... RIP: 0010:simplecopyto_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: _skbdatagramiter+0x123/0x8b0 (net/core/datagram.c:402) skbcopydatagramiter+0x77/0x1a0 (net/core/datagram.c:534) tipcrecvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) iorecvmsg+0x47e/0xda0

Fix by changing mint(int, ...) to mint(size_t, ...) in both functions. The result is always <= (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe.