---
id: CVE-2026-74283
title: 'tipc: require net admin for TIPCv2 netlink mutators'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tipc: require net admin for TIPCv2 netlink mutators

  TIPCv2 registers mutating generic-netlink operations without admin
  permission flags. Generic netlink only checks CA…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    b06fb5f78a9af0929aaa47c92d0b7bca0617fb25
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    52864c6c13dcc292481eabfeb3c31a86c3ec06f2
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    e87dcc1a644d087de0bb6c94c6dd28c29b89597f
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    9b937de4b3ded62a24da6e8d9d623cdb2748fa74
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    c9668a4adb2264625daeeabc7466b783badd4614
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    cebaefe1aceb650d5c99a4c0e1a4dde09e211818
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    56f0a2e0a1d004e025cd031c3a801ab73959269f
  - >-
    Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf <
    86b0c540e2ea397cde021eecd24145f7c16a3d4e
  - Linux 3.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:52:09.795417Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:30.055Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74283'
references:
  - url: 'https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25'
  - url: 'https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2'
  - url: 'https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f'
  - url: 'https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74'
  - url: 'https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614'
  - url: 'https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818'
  - url: 'https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f'
  - url: 'https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.0579
ingestedAt: '2026-10-16T19:46:24.384Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tipc: require net admin for TIPCv2 netlink mutators

TIPCv2 registers mutating generic-netlink operations without admin
permission flags. Generic netlink only checks CAP_NET_ADMIN when an
operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local
unprivileged process can currently change TIPC state through commands
such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and
bearer enable/disable.

The legacy TIPC netlink API already checks netlink_net_capable(...,
CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators
the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which
maps to the same namespace-aware CAP_NET_ADMIN check that
netlink_net_capable() performs, so the behaviour matches the legacy
path and keeps working for CAP_NET_ADMIN holders in a non-initial user
namespace (containers).

A QEMU/KASAN repro run as uid/gid 65534 with zero effective
capabilities previously succeeded in changing the network id and node
identity, setting and flushing key material, and enabling/disabling a
UDP bearer. With this patch applied the same operations fail with
-EPERM.

## Affected

- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < b06fb5f78a9af0929aaa47c92d0b7bca0617fb25`
- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < 52864c6c13dcc292481eabfeb3c31a86c3ec06f2`
- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < e87dcc1a644d087de0bb6c94c6dd28c29b89597f`
- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < 9b937de4b3ded62a24da6e8d9d623cdb2748fa74`
- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < c9668a4adb2264625daeeabc7466b783badd4614`
- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < cebaefe1aceb650d5c99a4c0e1a4dde09e211818`
- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < 56f0a2e0a1d004e025cd031c3a801ab73959269f`
- `Linux >= 0655f6a8635b1b66f2434d5556b1044c14b1ccaf < 86b0c540e2ea397cde021eecd24145f7c16a3d4e`
- `Linux 3.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.