High 7.8Published Aug 15, 2026

CVE-2026-74283tipc: require net admin for TIPCv2 netlink mutators

Updated under an hour ago (Oct 26, 2026, 5:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local unprivileged process can currently change TIPC state through commands such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable. The legacy TIPC netlink API already checks netlink_net_capable(..., CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which maps to the same namespace-aware CAP_NET_ADMIN check that netlink_net_capable() performs, so the behaviour matches the legacy path and keeps working for CAP_NET_ADMIN holders in a non-initial user namespace (containers). A QEMU/KASAN repro run as uid/gid 65534 with zero effective capabilities previously succeeded in changing the network id and node identity, setting and flushing key material, and enabling/disabling a UDP bearer. With this patch applied the same operations fail with -EPERM.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before b06fb5f78a9af0929aaa47c92d0b7bca0617fb25; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before 52864c6c13dcc292481eabfeb3c31a86c3ec06f2; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before e87dcc1a644d087de0bb6c94c6dd28c29b89597f; 0655f6a8635b1b66f2434d5556b1044c14b1ccaf builds before 9b937de4b3ded62a24da6e8d9d623cdb2748fa74; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before c9668a4adb2264625daeeabc7466b783badd4614; from 0655f6a8635b1b66f2434d5556b1044c14b1ccaf before cebaefe1aceb650d5c99a4c0e1a4dde09e211818; 0655f6a8635b1b66f2434d5556b1044c14b1ccaf builds before 56f0a2e0a1d004e025cd031c3a801ab73959269f; 0655f6a8635b1b66f2434d5556b1044c14b1ccaf builds before 86b0c540e2ea397cde021eecd24145f7c16a3d4e	CNA record

References

References

https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25
https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2
https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f
https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74
https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614
https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818
https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f
https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.