CVE-2026-74739net/sched: cls_u32: skip hash tables in u32_bind_class()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res->classid in tc_cls_bind_class(). The issue can be reproduced with the following commands: tc qdisc add dev lo root handle 1: hfsc tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1 tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit Fix this by skipping hash tables via the TC_U32_KEY(handle) check.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 before ec5f3005586a785689fd568361b0c5925cb1548b; from 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 before 19d114b93c94bdef70496f26685c2a6b242f41b3; from 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 before 594a064d603202b9ee21e07679d854e5c1750cc4; from 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 before 31f26a95eeee926946809ac456c61a3217936a62; from 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 before e71f8e9ed6f311410b14741f6012afe01869c0fa; 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 builds before 6d3724e616faf952c3adcf8414fc21a828ef3709 | CNA record |
References
- https://git.kernel.org/stable/c/ec5f3005586a785689fd568361b0c5925cb1548b
- https://git.kernel.org/stable/c/19d114b93c94bdef70496f26685c2a6b242f41b3
- https://git.kernel.org/stable/c/594a064d603202b9ee21e07679d854e5c1750cc4
- https://git.kernel.org/stable/c/31f26a95eeee926946809ac456c61a3217936a62
- https://git.kernel.org/stable/c/e71f8e9ed6f311410b14741f6012afe01869c0fa
- https://git.kernel.org/stable/c/6d3724e616faf952c3adcf8414fc21a828ef3709
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.