What is the CVSS score of CVE-2026-74255?

CVE-2026-74255 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74255?

CVE-2026-74255 is a critical Linux kernel vulnerability in the TIPC networking subsystem that can cause system denial-of-service and memory corruption on affected infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-74255?

Within 24 hours, inventory all Linux systems in production and determine which use TIPC networking (via tipc-config, kernel module inspection, /proc/net/tipc/, and network configuration review); obtain the patched kernel version from your Linux vendor's security advisory. Within 7 days, test the patch in a non-production environment matching production TIPC configurations, validating bearer activation and network throughput post-patch. Within 30 days, complete staged patching of all affected production systems beginning with non-critical infrastructure, then verify TIPC bearer status and performance metrics to confirm no regressions or service degradation.

Linux Kernel CVE-2026-74255

EUVD-2026-59402 CRITICAL

2026-08-15 Linux

GHSA-76v9-jpj5-v4rq

Google Information Disclosure Linux Red Hat

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.1 MEDIUM

Race on the privileged bearer-disable path (CAP_NET_ADMIN) makes it AV:L/AC:H/PR:H; realistic impact is a kernel crash (A:H), with memory-corruption escalation possible but unconfirmed.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:59 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 05:57 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix UAF in tipc_l2_send_msg()

Syzbot reported a slab-use-after-free in ipvlan_hard_header() when called from tipc_l2_send_msg().

The root cause is that tipc_disable_l2_media() calls synchronize_net() while b->media_ptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronize_net() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers.

Fix this by clearing b->media_ptr in tipc_disable_l2_media() before calling synchronize_net().

This is safe to do now because the call order in bearer_disable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipc_node_delete_links() (which needs the pointer) before disable_media().

https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u

AnalysisAI

Denial of service (and potential memory corruption) in the Linux kernel's TIPC networking subsystem arises from a use-after-free in tipc_l2_send_msg(); when a TIPC L2 bearer is disabled, tipc_disable_l2_media() runs synchronize_net() while b->media_ptr still references the underlying net_device, letting concurrent RCU readers keep sending on a device that is subsequently freed. Syzbot reproduced the slab-use-after-free via ipvlan_hard_header(). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain local privileged access to TIPC-enabled host

Delivery

Configure/transmit over TIPC L2 bearer

Exploit

Race bearer disable against send path

Execution

Trigger use-after-free on freed net_device

Impact

Kernel crash or memory corruption (DoS / potential escalation)

Access

Gain local privileged access to TIPC-enabled host

Delivery

Configure/transmit over TIPC L2 bearer

Exploit

Race bearer disable against send path

Execution

Trigger use-after-free on freed net_device

Impact

Kernel crash or memory corruption (DoS / potential escalation)

Vulnerability AssessmentAI

Exploitation	Requires the TIPC subsystem to be loaded and an L2 bearer configured over a real device (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-style CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) appears auto-generated and overstates real risk: this is a kernel race triggered on the bearer-disable administrative path, which in practice requires TIPC to be loaded/configured and privileged (CAP_NET_ADMIN) control of bearer state, not anonymous remote packets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	On a host with TIPC enabled over an L2 bearer, an attacker (or automated fuzzing harness, as syzbot demonstrated) races repeated bearer enable/disable operations against concurrent TIPC L2 transmit activity so that tipc_l2_send_msg() dereferences the net_device after it has been freed. The resulting slab-use-after-free typically crashes the kernel (DoS) and, depending on heap grooming, could be steered toward memory corruption. …
Remediation	Vendor-released patch: update to the fixed stable kernel for your series - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (7.2-rc1 in mainline) or later, applying your distribution's backport as it ships. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux systems in production and determine which use TIPC networking (via tipc-config, kernel module inspection, /proc/net/tipc/, and network configuration review); obtain the patched kernel version from your Linux vendor's security advisory. …

Threat intelligence, references, and detailed analysis are available after sign-in.