CVE-2026-74290net/sched: cls_flow: Dont expose folded kernel pointers
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: Dont expose folded kernel pointers The flow classifier falls back to addr_fold() for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can observe the resulting classid through class statistics. This allows a tc classifier in a user/network namespace to recover the 32-bit folded value of skb->sk, skb_dst() or skb_nfct(). Align with standard kernel practices for pointer hashing and replace the XOR folding with a keyed siphash (which is cryptographically secure)
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e5dfb815181fcb186d6080ac3a091eadff2d98fe before 19f2ecf8ea564562c7e7a919cf38068dd9aa1c96; from e5dfb815181fcb186d6080ac3a091eadff2d98fe before 3d054001860270748405a3f9270c5fa0bf7ffc19; from e5dfb815181fcb186d6080ac3a091eadff2d98fe before fb31fbe51c233f3bf47021121f63d2e42cac2d08; from e5dfb815181fcb186d6080ac3a091eadff2d98fe before 0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a; from e5dfb815181fcb186d6080ac3a091eadff2d98fe before 6151159618198675e01c391676e579738286c135; from e5dfb815181fcb186d6080ac3a091eadff2d98fe before f294fc71c4a0fa4964f6428a1b4e7929c1d83125 | CNA record |
References
- https://git.kernel.org/stable/c/19f2ecf8ea564562c7e7a919cf38068dd9aa1c96
- https://git.kernel.org/stable/c/3d054001860270748405a3f9270c5fa0bf7ffc19
- https://git.kernel.org/stable/c/fb31fbe51c233f3bf47021121f63d2e42cac2d08
- https://git.kernel.org/stable/c/0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a
- https://git.kernel.org/stable/c/6151159618198675e01c391676e579738286c135
- https://git.kernel.org/stable/c/f294fc71c4a0fa4964f6428a1b4e7929c1d83125
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.