Look up another CVE · open CVE-2026-74283 in the interactive tracker

CVE-2026-74283

tipc: require net admin for TIPCv2 netlink mutators

7.8 EPSS 0.2% AV:L

Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/tipc. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-74283 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixed	6.1.180-1	Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.100-1	Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local unprivileged process can currently change TIPC state through commands such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable. The legacy TIPC netlink API already checks netlink_net_capable(..., CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which maps to the same namespace-aware CAP_NET_ADMIN check that netlink_net_capable() performs, so the behaviour matches the legacy path and keeps working for CAP_NET_ADMIN holders in a non-initial user namespace (containers). A QEMU/KASAN repro run as uid/gid 65534 with zero effective capabilities previously succeeded in changing the network id and node identity, setting and flushing key material, and enabling/disabling a UDP bearer. With this patch applied the same operations fail with -EPERM.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/tipc/netlink.c

What this is: TIPC NETWORK LAYERMAINTAINERS section matched on net/tipc/ · netdev@vger.kernel.org · Maintained
Kernel module: tipc

Check it on the machine

grep -w CONFIG_TIPC /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w tipc

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_TIPC

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-15 (2 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.17%, higher than 5.8% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/tipc

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
3.19	5.10.261	b06fb5f78a9a
3.19	5.15.212	52864c6c13dc
3.19	6.1.178	e87dcc1a644d
3.19	6.6.145	9b937de4b3de
3.19	6.12.97	c9668a4adb22
3.19	6.18.40	cebaefe1aceb
3.19	7.1.5	56f0a2e0a1d0
3.19	7.2	86b0c540e2ea

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: Exploitation requires sending TIPCv2 generic-netlink commands via a local NETLINK_GENERIC socket; the flaw is a missing authorization check on netlink mutators, not remote packet handling in the TIPC data plane.
AC:LAttack complexity, low: Any unprivileged local process can open a generic-netlink socket and invoke the unprotected TIPCv2 mutators deterministically; no races, special memory layout, or victim state are required beyond TIPC being loaded.
PR:LPrivileges required, low: The fix commit reproduces the issue as uid/gid 65534 (nobody) with zero effective capabilities; no CAP_NET_ADMIN or root in the initial namespace is needed, only standard local user access.
UI:NUser interaction, none: No victim interaction is required; the attacker directly issues netlink configuration commands to alter TIPC cluster state.
S:UScope, unchanged: Impact is unauthorized kernel/TIPC administration within the caller’s network namespace (and global media tuning), not crossing a VM, container-to-host, or other distinct security-authority boundary.
C:HConfidentiality impact, high: Unprivileged callers can set or flush TIPC AEAD encryption keys and reconfigure node/network identity, enabling decryption or exposure of protected inter-node cluster traffic that should require administrator control.
I:HIntegrity impact, high: Attackers can arbitrarily modify TIPC network ID, node identity, bearer/link/media parameters, monitoring settings, and cluster peer state, subverting intended cluster topology and cryptographic configuration.
A:HAvailability impact, high: Unprivileged bearer disable/enable, peer removal, and key flush operations can repeatedly disrupt or partition TIPC cluster connectivity and encrypted communication, causing sustained denial of cluster service.