CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg()
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix UAF in tipcl2sendmsg()
Syzbot reported a slab-use-after-free in ipvlanhardheader() when called from tipcl2sendmsg().
The root cause is that tipcdisablel2media() calls synchronizenet() while b->mediaptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronizenet() has finished. The pointer is cleared later in bearerdisable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers.
Fix this by clearing b->mediaptr in tipcdisablel2media() before calling synchronizenet().
This is safe to do now because the call order in bearerdisable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipcnodedeletelinks() (which needs the pointer) before disablemedia().
https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (tipc)to a version that resolves this vulnerability.Fixed in 0d051bf93c06 - Operational
Ensure the fix is applied so that in tipc_disable_l2_media(), b->media_ptr is cleared before synchronize_net() and that bearer_disable()’s call order remains correct (tipc_node_delete_links() is called before b->media_ptr is cleared in order to keep the pointer valid for readers).