CVE-2026-74255tipc: fix UAF in tipc_l2_send_msg()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg(). The root cause is that tipc_disable_l2_media() calls synchronize_net() while b->media_ptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronize_net() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers. Fix this by clearing b->media_ptr in tipc_disable_l2_media() before calling synchronize_net(). This is safe to do now because the call order in bearer_disable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipc_node_delete_links() (which needs the pointer) before disable_media(). https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 282b3a056225b35024246f63feb91d769d714dad before 609ced2301be1df7e7ed2ef47d1d916674e6ba3b; 282b3a056225b35024246f63feb91d769d714dad builds before 71aafa16d79b107b33837f60b6cbc7d0cb8c5708; from 282b3a056225b35024246f63feb91d769d714dad before f4002f1c669cc02e3763f479fc25ff1dfa9e2420; 282b3a056225b35024246f63feb91d769d714dad builds before 50ff092633b06382e5091dd5b093ce943d4ac2f9; from 282b3a056225b35024246f63feb91d769d714dad before aef12b5ce793dea6b3a97a58fd0f946000ae8945; 282b3a056225b35024246f63feb91d769d714dad builds before 0d8a12d7143126afdf9fbe2e3d438650dd6603ed; 282b3a056225b35024246f63feb91d769d714dad builds before 35e0297a93c3c34a3924eeef816c03504e3ab5c5; from 282b3a056225b35024246f63feb91d769d714dad before f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6 | CNA record |
References
- https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b
- https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708
- https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420
- https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9
- https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945
- https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed
- https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5
- https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.