SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-74739

HIGH · CVSS 7.8 EPSS 0.14%

Source: NVD + CISA KEV + EPSS · Published 2026-08-26 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's traffic control subsystem, specifically within the u32 classification mechanism, where improper handling of hash tables can lead to a slab-out-of-bounds read. This flaw may allow an attacker to exploit memory access violations, potentially leading to information disclosure or system instability. Linux system administrators and developers working with network traffic control should prioritize this issue to mitigate potential risks.

CVE
CVE-2026-74739
Severity
HIGH
CVSS
7.8
EPSS
0.14%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res->classid in tc_cls_bind_class(). The issue can be reproduced with the following commands: tc qdisc add dev lo root handle 1: hfsc tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1 tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit Fix this by skipping hash tables via the TC_U32_KEY(handle) check.