{"id":"CVE-2026-74270","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 25fb53e43ec006ac69b9e825a7e8a11d63a6083e","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < b6557f912509abe8e70223373dd7a44d1d4a0d6c","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 67cec2f1eb9e58719d622e92e2278ceda72dbd85","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 4dafc411948469277b276724c3b2b4408c02c04c","Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 81246a65303d9635266b1334490142caaf86a11f","Linux 6.4"],"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:17:35.600","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74270","references":[{"url":"https://git.kernel.org/stable/c/25fb53e43ec006ac69b9e825a7e8a11d63a6083e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dafc411948469277b276724c3b2b4408c02c04c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67cec2f1eb9e58719d622e92e2278ceda72dbd85","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81246a65303d9635266b1334490142caaf86a11f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6557f912509abe8e70223373dd7a44d1d4a0d6c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00129,"epssPercentile":0.02485,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:51:52.912027Z"},"ingestedAt":"2026-10-16T19:46:24.386Z","slug":"CVE-2026-74270","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake agent\n(tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has\nno privilege check at all.\n\nThe fd-lookup in handshake_nl_done_doit() only confirms that\nsome pending handshake request exists for the supplied sockfd;\nit does not authenticate the sender. An unprivileged process\nthat guesses or observes a valid sockfd can therefore submit\na DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel\nconsumer to proceed as if the handshake succeeded. A non-zero\nstatus on a forged DONE tears down a legitimate in-flight\nhandshake before tlshd can report its real result.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}