CVE-2026-74283tipc: require net admin for TIPCv2 netlink mutators
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local unprivileged process can currently change TIPC state through commands such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable. The legacy TIPC netlink API already checks netlink_net_capable(..., CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which maps to the same namespace-aware CAP_NET_ADMIN check that netlink_net_capable() performs, so the behaviour matches the legacy path and keeps working for CAP_NET_ADMIN holders in a non-initial user namespace (containers). A QEMU/KASAN repro run as uid/gid 65534 with zero effective capabilities previously succeeded in changing the network id and node identity, setting and flushing key material, and enabling/disabling a UDP bearer. With this patch applied the same operations fail with -EPERM.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before b06fb5f78a9af0929aaa47c92d0b7bca0617fb25; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before 52864c6c13dcc292481eabfeb3c31a86c3ec06f2; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before e87dcc1a644d087de0bb6c94c6dd28c29b89597f; 0655f6a8635b1b66f2434d5556b1044c14b1ccaf builds before 9b937de4b3ded62a24da6e8d9d623cdb2748fa74; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before c9668a4adb2264625daeeabc7466b783badd4614; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before cebaefe1aceb650d5c99a4c0e1a4dde09e211818; 0655f6a8635b1b66f2434d5556b1044c14b1ccaf builds before 56f0a2e0a1d004e025cd031c3a801ab73959269f; 0655f6a8635b1b66f2434d5556b1044c14b1ccaf builds before 86b0c540e2ea397cde021eecd24145f7c16a3d4e | CNA record |
References
- https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25
- https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2
- https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f
- https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74
- https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614
- https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818
- https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f
- https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.