CVE-2026-74739

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-74739

Key Details

CVE	CVE-2026-74739
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: skip hash tables in u32_bind_class()

u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode

through the walker callback. u32_bind_class() unconditionally casts the

passed fh to tc_u_knode and accesses &n->res, so when fh is actually a

tc_u_hnode, which has no tcf_result member, this results in a

slab-out-of-bounds read of res->classid in tc_cls_bind_class().

The issue can be reproduced with the following commands:

tc qdisc add dev lo root handle 1: hfsc

tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit

tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1

tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit

Fix this by skipping hash tables via the TC_U32_KEY(handle) check. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-74739
CVE	https://www.cve.org/CVERecord?id=CVE-2026-74739

Source

Reference

NVD

CVE