What is the CVSS score of CVE-2026-74283?

CVE-2026-74283 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel TIPC are affected by CVE-2026-74283?

A privilege escalation vulnerability in Linux kernel networking (CVE-2026-74283) allows local users to alter network configurations and manipulate security keys without authorization.. A patch is available.

How to fix or mitigate CVE-2026-74283?

Within 24 hours, identify all systems running vulnerable TIPC kernel versions and map local user access patterns to assess exposure. Within 7 days, verify patch availability per vendor advisory and test the kernel update in a non-production environment to validate compatibility and TIPC functionality. Within 30 days, deploy the patched kernel to production systems, prioritizing those with untrusted local user access, containerized workloads, or critical network services, and perform post-deployment validation of network connectivity and TIPC operations.

Linux Kernel TIPC CVE-2026-74283

EUVD-2026-59430 HIGH

2026-08-15 Linux

GHSA-5jpm-p694-hhf9

Information Disclosure Linux Red Hat

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access and low privileges required; TIPC module must be loaded; all three impact dimensions high due to key material exposure and network disruption capability.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:12 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tipc: require net admin for TIPCv2 netlink mutators

TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local unprivileged process can currently change TIPC state through commands such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable.

The legacy TIPC netlink API already checks netlink_net_capable(..., CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which maps to the same namespace-aware CAP_NET_ADMIN check that netlink_net_capable() performs, so the behaviour matches the legacy path and keeps working for CAP_NET_ADMIN holders in a non-initial user namespace (containers).

A QEMU/KASAN repro run as uid/gid 65534 with zero effective capabilities previously succeeded in changing the network id and node identity, setting and flushing key material, and enabling/disabling a UDP bearer. With this patch applied the same operations fail with -EPERM.

AnalysisAI

Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain local unprivileged shell access

Delivery

Load or confirm TIPC module is active

Exploit

Open generic netlink socket to TIPC family

Execution

Issue TIPC_NL_KEY_FLUSH or TIPC_NL_NET_SET without CAP_NET_ADMIN

Persist

Manipulate cluster identity or cryptographic keying material

Impact

Disrupt TIPC cluster communications

Access

Obtain local unprivileged shell access

Delivery

Load or confirm TIPC module is active

Exploit

Open generic netlink socket to TIPC family

Execution

Issue TIPC_NL_KEY_FLUSH or TIPC_NL_NET_SET without CAP_NET_ADMIN

Persist

Manipulate cluster identity or cryptographic keying material

Impact

Disrupt TIPC cluster communications

Vulnerability AssessmentAI

Exploitation	Exploitation requires an interactive or programmatic local shell session on the target system running as any non-root uid (the QEMU/KASAN reproducer confirmed uid/gid 65534 with zero effective capabilities is sufficient). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated to the actual impact: a low-privileged local user achieves high confidentiality (key material exposure), high integrity (network identity manipulation), and high availability (bearer disruption) impact with no special attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local unprivileged user (e.g., a service account, a container process with uid 65534, or a compromised application process) opens a generic netlink socket and sends a TIPC_NL_KEY_FLUSH command without any CAP_NET_ADMIN capability. The kernel's GENL dispatcher, finding no GENL_ADMIN_PERM flag on the handler, processes the request and flushes all cluster cryptographic key material, breaking authenticated TIPC cluster communication. …
Remediation	The primary fix is to upgrade to a patched Linux kernel stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 or later in the respective stable series. … Detailed patch versions, workarounds, and compensating controls in full report.