CVE-2026-74255

A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) module. This use-after-free vulnerability occurs when the tipc_disable_l2_media() function calls synchronize_net() before properly invalidating a media pointer. This timing issue allows concurrent readers to access a memory region after it has been freed, which can lead to system instability or a denial of service.

A race in the TIPC L2 bearer disable path can leave b.media_ptr visible to RCU readers while the underlying net_device is being detached and released. A concurrent reader in tipc_l2_send_msg can then use a stale device pointer and reach a slab use after free in ipvlan_hard_header, causing at least a kernel crash. For the CVSS the PR:L is used for the paranoid score because reduced capability root, container root, or delegated CAP_NET_ADMIN may be enough to control TIPC bearer state in some deployments. The issue is not proven to be directly network reachable by packet traffic alone, but network activity can participate in the race once bearer teardown is triggered. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to a race based UAF in kernel networking code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.