{"id":"CVE-2026-74270","title":"handshake: Require admin permission for DONE command","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 25fb53e43ec006ac69b9e825a7e8a11d63a6083e","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < b6557f912509abe8e70223373dd7a44d1d4a0d6c","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 67cec2f1eb9e58719d622e92e2278ceda72dbd85","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 4dafc411948469277b276724c3b2b4408c02c04c","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 81246a65303d9635266b1334490142caaf86a11f","Linux 6.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:51:52.912027Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:29.298Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74270","references":[{"url":"https://git.kernel.org/stable/c/25fb53e43ec006ac69b9e825a7e8a11d63a6083e"},{"url":"https://git.kernel.org/stable/c/b6557f912509abe8e70223373dd7a44d1d4a0d6c"},{"url":"https://git.kernel.org/stable/c/67cec2f1eb9e58719d622e92e2278ceda72dbd85"},{"url":"https://git.kernel.org/stable/c/4dafc411948469277b276724c3b2b4408c02c04c"},{"url":"https://git.kernel.org/stable/c/81246a65303d9635266b1334490142caaf86a11f"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.06547,"ingestedAt":"2026-10-16T19:46:24.386Z","slug":"CVE-2026-74270","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake agent\n(tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has\nno privilege check at all.\n\nThe fd-lookup in handshake_nl_done_doit() only confirms that\nsome pending handshake request exists for the supplied sockfd;\nit does not authenticate the sender. An unprivileged process\nthat guesses or observes a valid sockfd can therefore submit\na DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel\nconsumer to proceed as if the handshake succeeded. A non-zero\nstatus on a forged DONE tears down a legitimate in-flight\nhandshake before tlshd can report its real result.\n\n## Affected\n\n- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 25fb53e43ec006ac69b9e825a7e8a11d63a6083e`\n- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < b6557f912509abe8e70223373dd7a44d1d4a0d6c`\n- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 67cec2f1eb9e58719d622e92e2278ceda72dbd85`\n- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 4dafc411948469277b276724c3b2b4408c02c04c`\n- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 81246a65303d9635266b1334490142caaf86a11f`\n- `Linux 6.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}