CVE-2026-74255

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the ipvlan hard header() function when called from tipc l2 send msg(). The problem occurs because tipc disable l2 media() invokes synchronize net() while the b->media ptr variable remains valid. This allows concurrent RCU (Read-Copy-Update) readers to obtain the device pointer after the synchronization process finishes. Since the pointer is cleared later in bearer disable() without further synchronization, the device can be freed while still being accessed by readers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.