CVE-2026-74255 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix UAF in tipc_l2_send_msg()

Syzbot reported a slab-use-after-free in ipvlan_hard_header() when
called from tipc_l2_send_msg().

The root cause is that tipc_disable_l2_media() calls synchronize_net()
while b->media_ptr is still valid. This allows concurrent RCU readers
to obtain the device pointer after synchronize_net() has finished.
The pointer is cleared later in bearer_disable(), but without any
subsequent synchronization, allowing the device to be freed while
still in use by readers.

Fix this by clearing b->media_ptr in tipc_disable_l2_media() before
calling synchronize_net().

This is safe to do now because the call order in bearer_disable()
was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic")
to call tipc_node_delete_links() (which needs the pointer) before
disable_media().

https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s TIPC networking stack, a use‑after‑free bug exists in tipc_l2_send_msg() when tipc_disable_l2_media() clears media_ptr after calling synchronize_net() while the pointer still points to a valid device. RCU readers can race this sequence and later access a freed memory location during bearer_disable(), causing the kernel to dereference freed memory. This memory corruption can crash the kernel or, if attacker‑controlled data is placed in the freed region, lead to arbitrary kernel code execution.

Affected Systems

All Linux kernel versions that lack commit 0d8a12d7, which introduces the early clearing of b->media_ptr, are vulnerable. The issue is not vendor specific; any distribution shipping a kernel without this patch is affected.

Risk and Exploitability

Based on the description, the likely attack vector requires an adversary to send specially crafted TIPC packets to a target system where the TIPC module is enabled. It is inferred that local or privileged access is needed to manipulate the TIPC traffic or reproduce the race condition. The EPSS score is under 1% and the vulnerability is not listed in CISA KEV, indicating a low probability of public exploitation. Nevertheless, the CVSS score of 9.8 classifies it as Critical, meaning that exploitation could trigger a kernel panic or privilege escalation on affected systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`282b3a056225b35024246f63feb91d769d714dad`	affected	< 609ced2301be1df7e7ed2ef47d1d916674e6ba3b
`282b3a056225b35024246f63feb91d769d714dad`	affected	< 71aafa16d79b107b33837f60b6cbc7d0cb8c5708
`282b3a056225b35024246f63feb91d769d714dad`	affected	< f4002f1c669cc02e3763f479fc25ff1dfa9e2420
`282b3a056225b35024246f63feb91d769d714dad`	affected	< 50ff092633b06382e5091dd5b093ce943d4ac2f9
`282b3a056225b35024246f63feb91d769d714dad`	affected	< aef12b5ce793dea6b3a97a58fd0f946000ae8945
`282b3a056225b35024246f63feb91d769d714dad`	affected	< 0d8a12d7143126afdf9fbe2e3d438650dd6603ed
`282b3a056225b35024246f63feb91d769d714dad`	affected	< 35e0297a93c3c34a3924eeef816c03504e3ab5c5
`282b3a056225b35024246f63feb91d769d714dad`	affected	< f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[282b3a056225b35024246f63feb91d769d714dad,609ced2301be1df7e7ed2ef47d1d916674e6ba3b)`	affected	code_commit	—
`[282b3a056225b35024246f63feb91d769d714dad,71aafa16d79b107b33837f60b6cbc7d0cb8c5708)`	affected	code_commit	—
`[282b3a056225b35024246f63feb91d769d714dad,f4002f1c669cc02e3763f479fc25ff1dfa9e2420)`	affected	code_commit	—
`[282b3a056225b35024246f63feb91d769d714dad,50ff092633b06382e5091dd5b093ce943d4ac2f9)`	affected	code_commit	—
`[282b3a056225b35024246f63feb91d769d714dad,aef12b5ce793dea6b3a97a58fd0f946000ae8945)`	affected	code_commit	—
`[282b3a056225b35024246f63feb91d769d714dad0d8a12d7143126afdf9fbe2e3d438650dd6603ed)`	affected	code_commit	—
`[282b3a056225b35024246f63feb91d769d714dad,35e0297a93c3c34a3924eeef816c03504e3ab5c5)`	affected	code_commit	—
`[282b3a056225b35024246f63feb91d769d714dad,f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.4`	affected	generic	—
`[0,4.4)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the commit fixing tipc_disable_l2_media() before calling synchronize_net()
If an immediate kernel upgrade is not possible, disable the TIPC kernel module or block TIPC traffic at the firewall to reduce the attack surface
Enable kernel crash dump logging and monitor for abnormal panics or memory corruption indicators that may signal exploitation attempts.

Generated by OpenCVE AI on August 22, 2026 at 01:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00506.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed
https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5
https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9
https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b
https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708
https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945
https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420
https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6
https://lore.kernel.org/linux-cve-announce/2026081541-CVE-2026-74255-caef@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74255
https://www.cve.org/CVERecord?id=CVE-2026-74255

History

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081541-CVE-2026-74255-caef@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74255 https://www.cve.org/CVERecord?id=CVE-2026-74255
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-788

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-788

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg(). The root cause is that tipc_disable_l2_media() calls synchronize_net() while b->media_ptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronize_net() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers. Fix this by clearing b->media_ptr in tipc_disable_l2_media() before calling synchronize_net(). This is safe to do now because the call order in bearer_disable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipc_node_delete_links() (which needs the pointer) before disable_media(). https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
Title		tipc: fix UAF in tipc_l2_send_msg()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5 https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9 https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708 https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945 https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420 https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:34.293Z

Updated: 2026-08-17T05:45:03.215Z

Reserved: 2026-08-15T05:44:03.876Z

Link: CVE-2026-74255

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:24.627

Modified: 2026-08-17T06:19:18.780

Link: CVE-2026-74255

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74255 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T01:15:05Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object