CVE-2026-74255

Status: UPDATED  |  Advisory ID: CVE-2026-74255

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix UAF in tipc_l2_send_msg()

Syzbot reported a slab-use-after-free in ipvlan_hard_header() when

called from tipc_l2_send_msg().

The root cause is that tipc_disable_l2_media() calls synchronize_net()

while b->media_ptr is still valid. This allows concurrent RCU readers

to obtain the device pointer after synchronize_net() has finished.

The pointer is cleared later in bearer_disable(), but without any

subsequent synchronization, allowing the device to be freed while

still in use by readers.

Fix this by clearing b->media_ptr in tipc_disable_l2_media() before

calling synchronize_net().

This is safe to do now because the call order in bearer_disable()

was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic")

to call tipc_node_delete_links() (which needs the pointer) before

disable_media().

https: //lore.kernel.org/netdev/[email protected]/T/#u (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References