Executive brief
The Linux kernel's TIPC networking protocol implementation failed to enforce administrative privilege checks on certain configuration operations exposed through the TIPCv2 netlink interface. A local unprivileged user could exploit this to modify critical network settings such as network identity, bearer configuration, and key material without proper authorization, potentially disrupting cluster communications or gaining unauthorized network control.
Technical details
The vulnerability is a privilege escalation (CWE-269) in TIPC's generic netlink operations. TIPCv2 registered mutating netlink commands (TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, TIPC_NL_BEARER_ENABLE/DISABLE, TIPC_NL_BEARER_ADD/SET, TIPC_NL_LINK_SET, TIPC_NL_LINK_RESET_STATS, TIPC_NL_MEDIA_SET, TIPC_NL_MON_SET) without the required GENL_UNS_ADMIN_PERM flag. This allowed unprivileged local processes to invoke these operations without the kernel checking CAP_NET_ADMIN capability. The fix adds GENL_UNS_ADMIN_PERM flags to affected operations, enabling the namespace-aware CAP_NET_ADMIN check that matches the legacy TIPC netlink API behavior. No network access required; only local filesystem access to the netlink socket interface.
Affected products
- Linux Linux kernel 5.0 and later up to 6.11 (and backported to earlier stable branches)
Timeline
- 2026-08-15: disclosed: Advisory published
- 2026-06-10: patched: Fix committed upstream by Michael Bommarito
- 2026-06-04: other: Vulnerability reported by Trail of Bits