Look up another CVE · open CVE-2026-74255 in the interactive tracker

CVE-2026-74255

tipc: fix UAF in tipc_l2_send_msg()

9.8 EPSS 0.5% AV:N

Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/tipc. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-74255 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixed	6.1.180-1	Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.100-1	Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg(). The root cause is that tipc_disable_l2_media() calls synchronize_net() while b->media_ptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronize_net() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers. Fix this by clearing b->media_ptr in tipc_disable_l2_media() before calling synchronize_net(). This is safe to do now because the call order in bearer_disable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipc_node_delete_links() (which needs the pointer) before disable_media(). https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/tipc/bearer.c

What this is: TIPC NETWORK LAYERMAINTAINERS section matched on net/tipc/ · netdev@vger.kernel.org · Maintained
Kernel module: tipc

Check it on the machine

grep -w CONFIG_TIPC /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w tipc

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_TIPC

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-15 (2 months ago)source
CVSS: 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.50%, higher than 41.5% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/tipc

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.4	5.10.261	609ced2301be
4.4	5.15.212	71aafa16d79b
4.4	6.1.178	f4002f1c669c
4.4	6.6.145	50ff092633b0
4.4	6.12.97	aef12b5ce793
4.4	6.18.40	0d8a12d71431
4.4	7.1.5	35e0297a93c3
4.4	7.2	f4c3d89fc986

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: tipc_l2_send_msg is reached from tipc_bearer_xmit during L2 TIPC protocol handling; remote ETH_P_TIPC frames on cluster/datacenter L2 networks drive outbound transmission that races with bearer teardown in tipc_disable_l2_media.
AC:LAttack complexity, low: The UAF window is a race where attackers control both sides by flooding TIPC Ethernet traffic while bearer disable runs and by concurrently triggering bearer teardown; syzbot reliably reproduced this without attacker-uncontrollable timing.
PR:NPrivileges required, none: An unauthenticated remote attacker only needs to send TIPC L2 frames on a segment with an active bearer; bearer_disable teardown during cluster failover, netdev unregister, or node shutdown creates the required concurrent disable without attacker-local privileges.
UI:NUser interaction, none: No victim user action is required; exploitation is triggered by remote protocol traffic concurrent with automated or administrative bearer/interface teardown events.
S:UScope, unchanged: Impact is kernel slab memory corruption and potential privilege escalation within the same kernel security boundary, not a cross-VM or cross-namespace escape.
C:HConfidentiality impact, high: Slab use-after-free of a net_device structure via ipvlan_hard_header enables reading freed kernel heap memory and can be leveraged for arbitrary kernel memory disclosure.
I:HIntegrity impact, high: UAF on net_device during dev_hard_header allows heap grooming and control of freed object contents, enabling arbitrary kernel writes and potential code execution.
A:HAvailability impact, high: The UAF causes kernel oops/panic (as reported by syzbot in ipvlan_hard_header) and can be triggered repeatedly to deny service on cluster nodes.