{"id":"CVE-2026-74270","summary":"handshake: Require admin permission for DONE command","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nhandshake: Require admin permission for DONE command\n\nACCEPT and DONE are the two downcalls of the handshake genl\nfamily, both intended for use by the trusted handshake agent\n(tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has\nno privilege check at all.\n\nThe fd-lookup in handshake_nl_done_doit() only confirms that\nsome pending handshake request exists for the supplied sockfd;\nit does not authenticate the sender. An unprivileged process\nthat guesses or observes a valid sockfd can therefore submit\na DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel\nconsumer to proceed as if the handshake succeeded. A non-zero\nstatus on a forged DONE tears down a legitimate in-flight\nhandshake before tlshd can report its real result.","modified":"2026-08-18T03:56:45.344507009Z","published":"2026-08-15T05:57:44.195Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74270.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/25fb53e43ec006ac69b9e825a7e8a11d63a6083e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4dafc411948469277b276724c3b2b4408c02c04c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/67cec2f1eb9e58719d622e92e2278ceda72dbd85"},{"type":"WEB","url":"https://git.kernel.org/stable/c/81246a65303d9635266b1334490142caaf86a11f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b6557f912509abe8e70223373dd7a44d1d4a0d6c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74270.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74270"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3b3009ea8abb713b022d94fba95ec270cf6e7eae"},{"fixed":"25fb53e43ec006ac69b9e825a7e8a11d63a6083e"},{"fixed":"b6557f912509abe8e70223373dd7a44d1d4a0d6c"},{"fixed":"67cec2f1eb9e58719d622e92e2278ceda72dbd85"},{"fixed":"4dafc411948469277b276724c3b2b4408c02c04c"},{"fixed":"81246a65303d9635266b1334490142caaf86a11f"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74270.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74270.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}