CVE-2026-74270

Received Received - Intake

Privilege Escalation in Linux Kernel Handshake

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent (tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has no privilege check at all. The fd-lookup in handshake_nl_done_doit() only confirms that some pending handshake request exists for the supplied sockfd; it does not authenticate the sender. An unprivileged process that guesses or observes a valid sockfd can therefore submit a DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel consumer to proceed as if the handshake succeeded. A non-zero status on a forged DONE tears down a legitimate in-flight handshake before tlshd can report its real result.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74270

EUVD

EUVD-2026-59417

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows an unprivileged process to manipulate the handshake process by sending a forged DONE command. The DONE command in the handshake generic netlink family lacks proper privilege checks, enabling attackers to either prematurely terminate legitimate handshakes or falsely indicate successful handshakes using a valid but observed socket file descriptor.

Detection Guidance

This vulnerability involves a missing privilege check in the Linux kernel's handshake genl family. Detection requires checking kernel logs for unusual handshake-related events or monitoring for unauthorized DONE commands. No specific commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to disrupt legitimate network services relying on the handshake mechanism, cause denial-of-service by terminating active connections, or trick systems into accepting unauthorized or malicious connections by faking successful handshakes.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel handshake mechanism requiring admin permissions. No evidence suggests it impacts data protection, privacy, or security controls covered by these regulations.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the missing privilege check in the handshake genl family. Ensure only trusted processes can interact with the handshake interface. Monitor kernel logs for suspicious activity related to handshake commands.

Hi! I’m here to help you understand CVE-2026-74270. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70