CVE-2026-74255

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix UAF in tipcl2send_msg()

Syzbot reported a slab-use-after-free in ipvlanhardheader() when called from tipcl2send_msg().

The root cause is that tipcdisablel2media() calls synchronizenet() while b->mediaptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronizenet() has finished. The pointer is cleared later in bearer_disable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers.

Fix this by clearing b->mediaptr in tipcdisablel2media() before calling synchronize_net().

This is safe to do now because the call order in bearerdisable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipcnodedeletelinks() (which needs the pointer) before disable_media().

https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u