CVE-2026-74283

Status: UPDATED  |  Advisory ID: CVE-2026-74283

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

tipc: require net admin for TIPCv2 netlink mutators

TIPCv2 registers mutating generic-netlink operations without admin

permission flags. Generic netlink only checks CAP_NET_ADMIN when an

operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local

unprivileged process can currently change TIPC state through commands

such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and

bearer enable/disable.

The legacy TIPC netlink API already checks netlink_net_capable(...,

CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators

the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which

maps to the same namespace-aware CAP_NET_ADMIN check that

netlink_net_capable() performs, so the behaviour matches the legacy

path and keeps working for CAP_NET_ADMIN holders in a non-initial user

namespace (containers).

A QEMU/KASAN repro run as uid/gid 65534 with zero effective

capabilities previously succeeded in changing the network id and node

identity, setting and flushing key material, and enabling/disabling a

UDP bearer. With this patch applied the same operations fail with

-EPERM. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References