CVE-2026-74270

A flaw was found in the Linux kernel's handshake mechanism. An unprivileged local attacker can exploit a missing permission check in the 'DONE' command of the handshake general Netlink (genl) family. By guessing or observing a valid socket identifier, the attacker can either force the kernel to believe a handshake succeeded, potentially leading to unauthorized operations, or disrupt an ongoing legitimate handshake, causing a Denial of Service (DoS).

This vulnerability is rated as an Important severity for Red Hat Enterprise Linux because an unprivileged local user can tamper with kernel-managed cryptographic session setups, enabling them to bypass transport layer security authentication or abruptly terminate legitimate connections without requiring administrative privileges. Successful exploitation requires an authenticated local user to send malformed Generic Netlink messages while an in-kernel consumer, such as kernel TLS or RPC-over-TLS, is actively negotiating a session on an identifiable socket. Older releases lacking the in-kernel handshake infrastructure do not include the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.