{"apiVersion":"1.0","identifier":"CVE-2026-74255","description":"In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg(). The root cause is that tipc_disable_l2_media() calls synchronize_net() while b->media_ptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronize_net() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers. Fix this by clearing b->media_ptr in tipc_disable_l2_media() before calling synchronize_net(). This is safe to do now because the call order in bearer_disable() was reversed in 0d051bf93c06 (-tipc: make bearer packet filtering generic-) to call tipc_node_delete_links() (which needs the pointer) before disable_media(). https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u","publishedAt":"2026-08-15T06:22:24","lastModifiedAt":"2026-08-17T06:19:18","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74255","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00506,"riskScore":1.02,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74255","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74255","en":"https://www.redsauce.net/en/cves/CVE-2026-74255","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74255","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74255","de":"https://www.redsauce.net/de/cves/CVE-2026-74255","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74255","el":"https://www.redsauce.net/el/cves/CVE-2026-74255"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74255"}}