CVE-2026-74255

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix UAF in tipcl2send_msg()

Syzbot reported a slab-use-after-free in ipvlanhardheader() when

called from tipcl2send_msg().

The root cause is that tipcdisablel2media() calls synchronizenet()

while b->media_ptr is still valid. This allows concurrent RCU readers

to obtain the device pointer after synchronize_net() has finished.

The pointer is cleared later in bearer_disable(), but without any

subsequent synchronization, allowing the device to be freed while

still in use by readers.

Fix this by clearing b->mediaptr in tipcdisablel2media() before

calling synchronize_net().

This is safe to do now because the call order in bearer_disable()

was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic")

to call tipcnodedelete_links() (which needs the pointer) before

disable_media().

https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u