CVE-2026-74255 tipc: fix UAF in tipc_l2_send_msg()
A use-after-free vulnerability in the Linux kernel's TIPC module allows attackers to cause denial of service or potentially execute code via race conditions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74255?
CVE-2026-74255 is a critical use after free vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix UAF in tipc_l2_send_msg()
Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg().
The root cause is that tipc_disable_l2_media() calls synchronize_net() while b->media_ptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronize_net() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers.
Fix this by clearing b->media_ptr in tipc_disable_l2_media() before calling synchronize_net().
This is safe to do now because the call order in bearer_disable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipc_node_delete_links() (which needs the pointer) before disable_media().
https: //lore.kernel.org/netdev/[email protected]/T/#u
Which versions are affected by CVE-2026-74255?
How do I fix CVE-2026-74255?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-74255 being exploited?
There is no known exploitation of CVE-2026-74255 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74255, DEBIAN-CVE-2026-74255, GHSA-76v9-jpj5-v4rq, UBUNTU-CVE-2026-74255.