CVE-2026-74736

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-74736

Key Details

CVE	CVE-2026-74736
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_bpf: reject dev-bound programs bound to a different device

cls_bpf_prog_from_efd() obtained a SCHED_CLS program via

bpf_prog_get_type_dev() but never verified that a device-bound (offloaded)

program's bound netdev matches the TC netdev the classifier is being

attached to. This let a program loaded with prog_ifindex for device A be

attached via cls_bpf + skip_sw to device B; deleting device A then

destroyed the program's offload state while it was still attached to

device B, triggering a netdevsim WARN (panic with panic_on_warn=1).

Mirror the XDP attach path (net/core/dev.c) and reject the attach with

-EINVAL when a dev-bound program's bound device does not match the

target device. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-74736
CVE	https://www.cve.org/CVERecord?id=CVE-2026-74736

Source

Reference

NVD

CVE