CVE-2026-74270 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
handshake: Require admin permission for DONE command
ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent (tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has no privilege check at all.
The fd-lookup in handshake_nl_done_doit() only confirms that some pending handshake request exists for the supplied sockfd; it does not authenticate the sender. An unprivileged process that guesses or observes a valid sockfd can therefore submit a DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel consumer to proceed as if the handshake succeeded. A non-zero status on a forged DONE tears down a legitimate in-flight handshake before tlshd can report its real result.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical privilege escalation flaw within the Linux kernel's handshake generic netlink family implementation. This issue resides in the communication mechanism between userspace and kernel space components, specifically affecting the trusted handshake agent (tlshd) infrastructure that manages secure network connections. The problem stems from an inconsistent security model where the ACCEPT command properly enforces administrative privileges through GENL_ADMIN_PERM checks while the DONE command lacks any authentication mechanism whatsoever. This discrepancy creates a dangerous attack vector that undermines the integrity of the entire handshake process.
The technical flaw manifests in the handshake_nl_done_doit() function which performs only a basic file descriptor lookup validation without implementing proper sender authentication. The function confirms that a pending handshake request exists for the specified socket file descriptor but fails to verify that the requesting process possesses legitimate administrative authority. This validation gap allows unprivileged user processes to forge DONE commands by simply guessing or observing valid socket file descriptor numbers. When such forged commands are submitted with HANDSHAKE_A_DONE_STATUS set to zero, they deceive the kernel consumer into treating the handshake as successful, effectively bypassing security controls that should only be accessible to authorized administrators.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential disruption of legitimate network operations and compromise of system security. An attacker can manipulate ongoing handshake processes by submitting forged DONE commands with non-zero status values, which will terminate legitimate in-flight handshakes before the trusted handshake agent (tlshd) can report their actual outcomes. This capability enables attackers to either prematurely conclude secure connections or corrupt active security sessions, potentially leading to unauthorized access to protected network resources. The vulnerability essentially allows any unprivileged user to influence kernel-level security decisions that should remain restricted to authorized administrative processes.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 Access Control Issues, specifically manifesting as improper privilege management within kernel space operations. The flaw also maps to ATT&CK technique T1068 Privilege Escalation through the exploitation of kernel-level access control mechanisms. The security implications are particularly severe because they affect a fundamental network security infrastructure component that operates at the kernel level and interacts with critical system functions. The vulnerability demonstrates poor least privilege implementation where administrative controls should be enforced but are instead bypassable by any user process. This issue highlights the importance of consistent security enforcement across all kernel interfaces and underscores the necessity of comprehensive privilege validation mechanisms in trusted system components.
Mitigation strategies for this vulnerability require immediate implementation of proper administrative permission checks for the DONE command within the handshake generic netlink family. The fix should involve adding GENL_ADMIN_PERM validation to the handshake_nl_done_doit() function, ensuring that only processes with appropriate administrative privileges can submit DONE commands. Additionally, system administrators should consider implementing monitoring solutions to detect anomalous DONE command submissions and establish proper access controls for network security components. The kernel patch should also include enhanced logging of handshake operations to enable forensic analysis of potential exploitation attempts. Organizations must ensure that all kernel interfaces maintain consistent privilege enforcement models and that administrative commands properly validate sender credentials before executing sensitive operations.