DEBIAN-CVE-2026-74255

In the Linux kernel, the following vulnerability has been resolved:  tipc: fix UAF in tipcl2sendmsg()  Syzbot reported a slab-use-after-free in ipvlanhardheader() when called from tipcl2sendmsg().  The root cause is that tipcdisablel2media() calls synchronizenet() while b->mediaptr is still valid. This allows concurrent RCU readers to obtain the device pointer after synchronizenet() has finished. The pointer is cleared later in bearerdisable(), but without any subsequent synchronization, allowing the device to be freed while still in use by readers.  Fix this by clearing b->mediaptr in tipcdisablel2media() before calling synchronizenet().  This is safe to do now because the call order in bearerdisable() was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic") to call tipcnodedeletelinks() (which needs the pointer) before disable_media().  https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u