CVE-2026-74283

In the Linux kernel, the following vulnerability has been resolved:

tipc: require net admin for TIPCv2 netlink mutators

TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or GENLUNSADMINPERM, so a local unprivileged process can currently change TIPC state through commands such as TIPCNLNETSET, TIPCNLKEYSET, TIPCNLKEYFLUSH, and bearer enable/disable.

The legacy TIPC netlink API already checks netlinknetcapable(..., CAPNETADMIN) for administrative commands. Give the TIPCv2 mutators the equivalent generic-netlink gate. Use GENLUNSADMINPERM, which maps to the same namespace-aware CAPNETADMIN check that netlinknetcapable() performs, so the behaviour matches the legacy path and keeps working for CAPNET_ADMIN holders in a non-initial user namespace (containers).

A QEMU/KASAN repro run as uid/gid 65534 with zero effective capabilities previously succeeded in changing the network id and node identity, setting and flushing key material, and enabling/disabling a UDP bearer. With this patch applied the same operations fail with -EPERM.