CVE-2026-74283tipc: require net admin for TIPCv2 netlink mutators
- 7.8HighCVSS base score
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local unprivileged process can currently change TIPC state through commands such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable. The legacy TIPC netlink API already checks netlink_net_capable(..., CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which maps to the same namespace-aware CAP_NET_ADMIN check that netlink_net_capable() performs, so the behaviour matches the legacy path and keeps working for CAP_NET_ADMIN holders in a non-initial user namespace (containers). A QEMU/KASAN repro run as uid/gid 65534 with zero effective capabilities previously succeeded in changing the network id and node identity, setting and flushing key material, and enabling/disabling a UDP bearer. With this patch applied the same operations fail with -EPERM.
Timeline
ID reserved
By Linux
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < b06fb5f78a9af0929aaa47c92d0b7bca0617fb25
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < 52864c6c13dcc292481eabfeb3c31a86c3ec06f2
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < e87dcc1a644d087de0bb6c94c6dd28c29b89597f
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < 9b937de4b3ded62a24da6e8d9d623cdb2748fa74
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < c9668a4adb2264625daeeabc7466b783badd4614
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < cebaefe1aceb650d5c99a4c0e1a4dde09e211818
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < 56f0a2e0a1d004e025cd031c3a801ab73959269f
- affected 0655f6a8635b1b66f2434d5556b1044c14b1ccaf – < 86b0c540e2ea397cde021eecd24145f7c16a3d4e
- affected 3.19
- unaffected < 3.19
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25 (opens in a new tab)
- https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2 (opens in a new tab)
- https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f (opens in a new tab)
- https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74 (opens in a new tab)
- https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614 (opens in a new tab)
- https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818 (opens in a new tab)
- https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f (opens in a new tab)
- https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-59430 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-74283)Record last updated .