CVE-2026-74283

The vulnerability in CVE-2026-74283 isn't a new attack surface — it's a missing control that should have been carried over from the legacy implementation. TIPCv2, built on the generic-netlink framework, lacks the CAP_NET_ADMIN check that the original netlink path has enforced all along. A process running as uid 65534 with zero capabilities could manipulate bearer state, key material, and network topology through TIPCv2 — operations the legacy API would reject immediately. A QEMU/KASAN test case confirmed this gap. The root cause is structural, not negligent. Generic-netlink makes security controls opt-in rather than opt-out. The framework provides permission flags that individual subsystem authors must explicitly configure — there's no mandatory gate that fires when you register a family that mutates network state. When TIPCv2 was built, the developers focused on getting the logic and performance right. The CAP_NET_ADMIN check that existed in v1 was treated as a "we'll add it before upstream" deferred task that never got enforced, because the framework never reminded them it was missing. This is the cognitive trap: the path of least resistance is the insecure path. The fix applies GENL_UNS_ADMIN_PERM correctly — this flag preserves namespace-aware semantics so that CAP_NET_ADMIN holders inside containers (non-initial user namespace) still pass the check, matching the legacy v1 behavior. However, this is a single hotfix for a systemic problem. The generic-netlink framework has no mechanism to flag permission model divergence between a v2 implementation and its v1 predecessor. There is no automated check that says "this family mirrors the permission model of that family" or "these operations inherit their legacy access control decisions." This pattern is a known lineage marker in kernel development. When subsystems acquire parallel code paths for the same logical operation, the second path replicates the happy-path logic but inherits none of the defensive baggage accumulated through previous CVEs and bug reports. TIPC's role as a cluster messaging fabric amplifies the impact — manipulating bearer state and key material on one node can destabilize topology for the entire cluster, making the blast radius multiplicative rather than additive. Reviewers cannot be expected to carry the full CVE history of every subsystem in their heads. The structural gap is that the framework treats security provenance as irrelevant. A systematic solution would require either making CAP_NET_ADMIN the implicit default for network-mutating generic-netlink families, or tooling that flags permission model divergence during review. Until then, every v2 port is a potential replay of this gap.

Reviewed through automated stages and approved by a human before publication.