In the Linux kernel, the following vulnerability has been resolved:

tipc: reject inverted service ranges from peer bindings

tipc_update_nametbl() inserts a binding advertised by a peer node using
the lower and upper service-range bounds taken directly from the wire,
without checking that lower <= upper. The local bind path validates the
ordering (tipc_uaddr_valid()), but the name-distribution path does not.

A binding with lower > upper is inserted at the far end of the
service-range rbtree (keyed on lower) where no lookup or withdrawal can
ever match it (service_range_foreach_match() requires sr->lower <= end).
The publication, its service_range node and the augmented rbtree entry
are then leaked for the lifetime of the namespace, and there is no
per-peer cap equivalent to TIPC_MAX_PUBL on locally created bindings.

Reject inverted ranges in the network path as well. A peer node can
otherwise leak unbounded binding-table memory by sending PUBLICATION
items with lower > upper.

https://git.kernel.org/stable/c/2afb648f7b99216c687db1f89739c995e1144153

https://git.kernel.org/stable/c/581ef56e5c34d475056ce086dc2ba0e872ba6857

https://git.kernel.org/stable/c/7e401233f9bb74a626e70698d0d62f3a94ac0676

https://git.kernel.org/stable/c/973bf0ed896b9898668dbadb82ed849d7d573010

https://git.kernel.org/stable/c/cd1955f81bd8ebeef51b324989ac871ad1947fb6

https://git.kernel.org/stable/c/f1715d92ee3095d9215b493a8603a81f646fcf61

https://git.kernel.org/stable/c/f683200b83a0085d4e11abea8c1fdd9fdfb95b0b

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/tipc/name_distr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"37922ea4a3105176357c8d565a9d982c4a08714a","lessThan":"cd1955f81bd8ebeef51b324989ac871ad1947fb6","versionType":"git","status":"affected"},{"version":"37922ea4a3105176357c8d565a9d982c4a08714a","lessThan":"f683200b83a0085d4e11abea8c1fdd9fdfb95b0b","versionType":"git","status":"affected"},{"version":"37922ea4a3105176357c8d565a9d982c4a08714a","lessThan":"f1715d92ee3095d9215b493a8603a81f646fcf61","versionType":"git","status":"affected"},{"version":"37922ea4a3105176357c8d565a9d982c4a08714a","lessThan":"581ef56e5c34d475056ce086dc2ba0e872ba6857","versionType":"git","status":"affected"},{"version":"37922ea4a3105176357c8d565a9d982c4a08714a","lessThan":"7e401233f9bb74a626e70698d0d62f3a94ac0676","versionType":"git","status":"affected"},{"version":"37922ea4a3105176357c8d565a9d982c4a08714a","lessThan":"973bf0ed896b9898668dbadb82ed849d7d573010","versionType":"git","status":"affected"},{"version":"37922ea4a3105176357c8d565a9d982c4a08714a","lessThan":"2afb648f7b99216c687db1f89739c995e1144153","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/tipc/name_distr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]