CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators
In the Linux kernel, the following vulnerability has been resolved:
tipc: require net admin for TIPCv2 netlink mutators
TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or GENLUNSADMINPERM, so a local unprivileged process can currently change TIPC state through commands such as TIPCNLNETSET, TIPCNLKEYSET, TIPCNLKEYFLUSH, and bearer enable/disable.
The legacy TIPC netlink API already checks netlinknetcapable(..., CAPNETADMIN) for administrative commands. Give the TIPCv2 mutators the equivalent generic-netlink gate. Use GENLUNSADMINPERM, which maps to the same namespace-aware CAPNETADMIN check that netlinknetcapable() performs, so the behaviour matches the legacy path and keeps working for CAPNETADMIN holders in a non-initial user namespace (containers).
A QEMU/KASAN repro run as uid/gid 65534 with zero effective capabilities previously succeeded in changing the network id and node identity, setting and flushing key material, and enabling/disabling a UDP bearer. With this patch applied the same operations fail with -EPERM.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel TIPC (TIPCv2)to a version that resolves this vulnerability.Patch tipc: require net admin for TIPCv2 netlink mutators - Configuration
Apply the change so TIPCv2 mutators use GENL_UNS_ADMIN_PERM, mapping to the same namespace-aware CAP_NET_ADMIN check as the legacy TIPC netlink API (netlink_net_capable), preventing unprivileged users from mutating TIPC state.
TIPCv2 generic-netlink operations permission flags = GENL_UNS_ADMIN_PERM (namespace-aware CAP_NET_ADMIN check)