CVE-2026-74283

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74283", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.881Z", "datePublished": "2026-08-15T05:57:52.667Z", "dateUpdated": "2026-10-16T18:55:30.055Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:24.502Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: require net admin for TIPCv2 netlink mutators\n\nTIPCv2 registers mutating generic-netlink operations without admin\npermission flags. Generic netlink only checks CAP_NET_ADMIN when an\noperation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local\nunprivileged process can currently change TIPC state through commands\nsuch as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and\nbearer enable/disable.\n\nThe legacy TIPC netlink API already checks netlink_net_capable(...,\nCAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators\nthe equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which\nmaps to the same namespace-aware CAP_NET_ADMIN check that\nnetlink_net_capable() performs, so the behaviour matches the legacy\npath and keeps working for CAP_NET_ADMIN holders in a non-initial user\nnamespace (containers).\n\nA QEMU/KASAN repro run as uid/gid 65534 with zero effective\ncapabilities previously succeeded in changing the network id and node\nidentity, setting and flushing key material, and enabling/disabling a\nUDP bearer. With this patch applied the same operations fail with\n-EPERM."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires sending TIPCv2 generic-netlink commands via a local NETLINK_GENERIC socket; the flaw is a missing authorization check on netlink mutators, not remote packet handling in the TIPC data plane.\nAC:L - Any unprivileged local process can open a generic-netlink socket and invoke the unprotected TIPCv2 mutators deterministically; no races, special memory layout, or victim state are required beyond TIPC being loaded.\nPR:L - The fix commit reproduces the issue as uid/gid 65534 (nobody) with zero effective capabilities; no CAP_NET_ADMIN or root in the initial namespace is needed, only standard local user access.\nUI:N - No victim interaction is required; the attacker directly issues netlink configuration commands to alter TIPC cluster state.\nS:U - Impact is unauthorized kernel/TIPC administration within the caller\u2019s network namespace (and global media tuning), not crossing a VM, container-to-host, or other distinct security-authority boundary.\nC:H - Unprivileged callers can set or flush TIPC AEAD encryption keys and reconfigure node/network identity, enabling decryption or exposure of protected inter-node cluster traffic that should require administrator control.\nI:H - Attackers can arbitrarily modify TIPC network ID, node identity, bearer/link/media parameters, monitoring settings, and cluster peer state, subverting intended cluster topology and cryptographic configuration.\nA:H - Unprivileged bearer disable/enable, peer removal, and key flush operations can repeatedly disrupt or partition TIPC cluster connectivity and encrypted communication, causing sustained denial of cluster service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/netlink.c"], "versions": [{"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "b06fb5f78a9af0929aaa47c92d0b7bca0617fb25", "status": "affected", "versionType": "git"}, {"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "52864c6c13dcc292481eabfeb3c31a86c3ec06f2", "status": "affected", "versionType": "git"}, {"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "e87dcc1a644d087de0bb6c94c6dd28c29b89597f", "status": "affected", "versionType": "git"}, {"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "9b937de4b3ded62a24da6e8d9d623cdb2748fa74", "status": "affected", "versionType": "git"}, {"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "c9668a4adb2264625daeeabc7466b783badd4614", "status": "affected", "versionType": "git"}, {"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "cebaefe1aceb650d5c99a4c0e1a4dde09e211818", "status": "affected", "versionType": "git"}, {"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "56f0a2e0a1d004e025cd031c3a801ab73959269f", "status": "affected", "versionType": "git"}, {"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "86b0c540e2ea397cde021eecd24145f7c16a3d4e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/netlink.c"], "versions": [{"version": "3.19", "status": "affected"}, {"version": "0", "lessThan": "3.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25"}, {"url": "https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2"}, {"url": "https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f"}, {"url": "https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74"}, {"url": "https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614"}, {"url": "https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818"}, {"url": "https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f"}, {"url": "https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e"}], "title": "tipc: require net admin for TIPCv2 netlink mutators", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74283", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:52:09.795417Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:30.055Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74283", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:52:09.795417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:52:10.379Z"}}], "cna": {"title": "tipc: require net admin for TIPCv2 netlink mutators", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires sending TIPCv2 generic-netlink commands via a local NETLINK_GENERIC socket; the flaw is a missing authorization check on netlink mutators, not remote packet handling in the TIPC data plane.\nAC:L - Any unprivileged local process can open a generic-netlink socket and invoke the unprotected TIPCv2 mutators deterministically; no races, special memory layout, or victim state are required beyond TIPC being loaded.\nPR:L - The fix commit reproduces the issue as uid/gid 65534 (nobody) with zero effective capabilities; no CAP_NET_ADMIN or root in the initial namespace is needed, only standard local user access.\nUI:N - No victim interaction is required; the attacker directly issues netlink configuration commands to alter TIPC cluster state.\nS:U - Impact is unauthorized kernel/TIPC administration within the caller\u2019s network namespace (and global media tuning), not crossing a VM, container-to-host, or other distinct security-authority boundary.\nC:H - Unprivileged callers can set or flush TIPC AEAD encryption keys and reconfigure node/network identity, enabling decryption or exposure of protected inter-node cluster traffic that should require administrator control.\nI:H - Attackers can arbitrarily modify TIPC network ID, node identity, bearer/link/media parameters, monitoring settings, and cluster peer state, subverting intended cluster topology and cryptographic configuration.\nA:H - Unprivileged bearer disable/enable, peer removal, and key flush operations can repeatedly disrupt or partition TIPC cluster connectivity and encrypted communication, causing sustained denial of cluster service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "b06fb5f78a9af0929aaa47c92d0b7bca0617fb25", "versionType": "git"}, {"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "52864c6c13dcc292481eabfeb3c31a86c3ec06f2", "versionType": "git"}, {"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "e87dcc1a644d087de0bb6c94c6dd28c29b89597f", "versionType": "git"}, {"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "9b937de4b3ded62a24da6e8d9d623cdb2748fa74", "versionType": "git"}, {"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "c9668a4adb2264625daeeabc7466b783badd4614", "versionType": "git"}, {"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "cebaefe1aceb650d5c99a4c0e1a4dde09e211818", "versionType": "git"}, {"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "56f0a2e0a1d004e025cd031c3a801ab73959269f", "versionType": "git"}, {"status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "lessThan": "86b0c540e2ea397cde021eecd24145f7c16a3d4e", "versionType": "git"}], "programFiles": ["net/tipc/netlink.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"status": "unaffected", "version": "0", "lessThan": "3.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/tipc/netlink.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25"}, {"url": "https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2"}, {"url": "https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f"}, {"url": "https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74"}, {"url": "https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614"}, {"url": "https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818"}, {"url": "https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f"}, {"url": "https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: require net admin for TIPCv2 netlink mutators\n\nTIPCv2 registers mutating generic-netlink operations without admin\npermission flags. Generic netlink only checks CAP_NET_ADMIN when an\noperation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local\nunprivileged process can currently change TIPC state through commands\nsuch as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and\nbearer enable/disable.\n\nThe legacy TIPC netlink API already checks netlink_net_capable(...,\nCAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators\nthe equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which\nmaps to the same namespace-aware CAP_NET_ADMIN check that\nnetlink_net_capable() performs, so the behaviour matches the legacy\npath and keeps working for CAP_NET_ADMIN holders in a non-initial user\nnamespace (containers).\n\nA QEMU/KASAN repro run as uid/gid 65534 with zero effective\ncapabilities previously succeeded in changing the network id and node\nidentity, setting and flushing key material, and enabling/disabling a\nUDP bearer. With this patch applied the same operations fail with\n-EPERM."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:24.502Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74283", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:30.055Z", "dateReserved": "2026-08-15T05:44:03.881Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:57:52.667Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tipc/netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b06fb5f78a9af0929aaa47c92d0b7bca0617fb25", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}, {"lessThan": "52864c6c13dcc292481eabfeb3c31a86c3ec06f2", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}, {"lessThan": "e87dcc1a644d087de0bb6c94c6dd28c29b89597f", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}, {"lessThan": "9b937de4b3ded62a24da6e8d9d623cdb2748fa74", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}, {"lessThan": "c9668a4adb2264625daeeabc7466b783badd4614", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}, {"lessThan": "cebaefe1aceb650d5c99a4c0e1a4dde09e211818", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}, {"lessThan": "56f0a2e0a1d004e025cd031c3a801ab73959269f", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}, {"lessThan": "86b0c540e2ea397cde021eecd24145f7c16a3d4e", "status": "affected", "version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tipc/netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"lessThan": "3.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: require net admin for TIPCv2 netlink mutators\n\nTIPCv2 registers mutating generic-netlink operations without admin\npermission flags. Generic netlink only checks CAP_NET_ADMIN when an\noperation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local\nunprivileged process can currently change TIPC state through commands\nsuch as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and\nbearer enable/disable.\n\nThe legacy TIPC netlink API already checks netlink_net_capable(...,\nCAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators\nthe equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which\nmaps to the same namespace-aware CAP_NET_ADMIN check that\nnetlink_net_capable() performs, so the behaviour matches the legacy\npath and keeps working for CAP_NET_ADMIN holders in a non-initial user\nnamespace (containers).\n\nA QEMU/KASAN repro run as uid/gid 65534 with zero effective\ncapabilities previously succeeded in changing the network id and node\nidentity, setting and flushing key material, and enabling/disabling a\nUDP bearer. With this patch applied the same operations fail with\n-EPERM."}], "id": "CVE-2026-74283", "lastModified": "2026-10-16T19:17:36.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74283", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:52:09.795417Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:27.780", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tipc: require net admin for TIPCv2 netlink mutators", "id": "2516935", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516935"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntipc: require net admin for TIPCv2 netlink mutators\nTIPCv2 registers mutating generic-netlink operations without admin\npermission flags. Generic netlink only checks CAP_NET_ADMIN when an\noperation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local\nunprivileged process can currently change TIPC state through commands\nsuch as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and\nbearer enable/disable.\nThe legacy TIPC netlink API already checks netlink_net_capable(...,\nCAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators\nthe equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which\nmaps to the same namespace-aware CAP_NET_ADMIN check that\nnetlink_net_capable() performs, so the behaviour matches the legacy\npath and keeps working for CAP_NET_ADMIN holders in a non-initial user\nnamespace (containers).\nA QEMU/KASAN repro run as uid/gid 65534 with zero effective\ncapabilities previously succeeded in changing the network id and node\nidentity, setting and flushing key material, and enabling/disabling a\nUDP bearer. With this patch applied the same operations fail with\n-EPERM.", "A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC network configurations, such as network and node identities, manage key material, and control UDP bearers. This unauthorized access could lead to significant disruption or compromise of network communication."], "name": "CVE-2026-74283", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74283\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74283\nhttps://lore.kernel.org/linux-cve-announce/2026081546-CVE-2026-74283-7822@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,b06fb5f78a9af0929aaa47c92d0b7bca0617fb25)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,52864c6c13dcc292481eabfeb3c31a86c3ec06f2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,e87dcc1a644d087de0bb6c94c6dd28c29b89597f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,9b937de4b3ded62a24da6e8d9d623cdb2748fa74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,c9668a4adb2264625daeeabc7466b783badd4614)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,cebaefe1aceb650d5c99a4c0e1a4dde09e211818)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,56f0a2e0a1d004e025cd031c3a801ab73959269f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0655f6a8635b1b66f2434d5556b1044c14b1ccaf,86b0c540e2ea397cde021eecd24145f7c16a3d4e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:45:06.850928+00:00", "updated": "2026-08-22T04:15:03.676531+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}