Critical 9.8Published Aug 15, 2026

CVE-2026-74255tipc: fix UAF in tipc_l2_send_msg()

Updated under an hour ago (Oct 27, 2026, 1:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg(). The root cause is that tipc_disable_l2_media() calls synchronize_net() while b->media_ptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronize_net() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers. Fix this by clearing b->media_ptr in tipc_disable_l2_media() before calling synchronize_net(). This is safe to do now because the call order in bearer_disable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipc_node_delete_links() (which needs the pointer) before disable_media(). https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 282b3a056225b35024246f63feb91d769d714dad before 609ced2301be1df7e7ed2ef47d1d916674e6ba3b; 282b3a056225b35024246f63feb91d769d714dad builds before 71aafa16d79b107b33837f60b6cbc7d0cb8c5708; from 282b3a056225b35024246f63feb91d769d714dad before f4002f1c669cc02e3763f479fc25ff1dfa9e2420; 282b3a056225b35024246f63feb91d769d714dad builds before 50ff092633b06382e5091dd5b093ce943d4ac2f9; from 282b3a056225b35024246f63feb91d769d714dad before aef12b5ce793dea6b3a97a58fd0f946000ae8945; 282b3a056225b35024246f63feb91d769d714dad builds before 0d8a12d7143126afdf9fbe2e3d438650dd6603ed; 282b3a056225b35024246f63feb91d769d714dad builds before 35e0297a93c3c34a3924eeef816c03504e3ab5c5; from 282b3a056225b35024246f63feb91d769d714dad before f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6	CNA record

References

References

https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b
https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708
https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420
https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9
https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945
https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed
https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5
https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.