{"id":"CVE-2026-74270","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-74270","summary":"handshake: Require admin permission for DONE command","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake agent\n(tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has\nno privilege check at all.\n\nThe fd-lookup in handshake_nl_done_doit() only confirms that\nsome pending handshake request exists for the supplied sockfd;\nit does not authenticate the sender. An unprivileged process\nthat guesses or observes a valid sockfd can therefore submit\na DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel\nconsumer to proceed as if the handshake succeeded. A non-zero\nstatus on a forged DONE tears down a legitimate in-flight\nhandshake before tlshd can report its real result.","published":"2026-08-15T05:57:44.195Z","modified":"2026-08-18T03:56:45.344507009Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.145"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/25fb53e43ec006ac69b9e825a7e8a11d63a6083e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4dafc411948469277b276724c3b2b4408c02c04c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/67cec2f1eb9e58719d622e92e2278ceda72dbd85"},{"type":"WEB","url":"https://git.kernel.org/stable/c/81246a65303d9635266b1334490142caaf86a11f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b6557f912509abe8e70223373dd7a44d1d4a0d6c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74270.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74270"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:45.344507009Z"}}