GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74736 (GCVE-0-2026-74736)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:36 – Updated: 2026-08-27 05:00
VLAI
Title
net/sched: cls_bpf: reject dev-bound programs bound to a different device
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1). Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < ec5a552f4b2d841c6c021752450716e1a9676661 (git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < daf546ab5763ce6a18280cb4db060e836c515301 (git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < adb3e7c26a51a10d94a241c6de7a81a2863dcacf (git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 5685bbbd3cbfbeb0de96a1d275a5ca073dfebb5e (git)
Affected: 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 , < 120977e2c096deea4e866e4273be9220b957c29e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ec5a552f4b2d841c6c021752450716e1a9676661",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "daf546ab5763ce6a18280cb4db060e836c515301",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "adb3e7c26a51a10d94a241c6de7a81a2863dcacf",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "5685bbbd3cbfbeb0de96a1d275a5ca073dfebb5e",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "120977e2c096deea4e866e4273be9220b957c29e",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_bpf: reject dev-bound programs bound to a different device\n\ncls_bpf_prog_from_efd() obtained a SCHED_CLS program via\nbpf_prog_get_type_dev() but never verified that a device-bound (offloaded)\nprogram\u0027s bound netdev matches the TC netdev the classifier is being\nattached to. This let a program loaded with prog_ifindex for device A be\nattached via cls_bpf + skip_sw to device B; deleting device A then\ndestroyed the program\u0027s offload state while it was still attached to\ndevice B, triggering a netdevsim WARN (panic with panic_on_warn=1).\n\nMirror the XDP attach path (net/core/dev.c) and reject the attach with\n-EINVAL when a dev-bound program\u0027s bound device does not match the\ntarget device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local RTM_NEWTFILTER and bpf(2) syscalls to misattach a dev-bound cls_bpf program and delete the bound netdev; received network packets are not the trigger and no remote pre-auth path reaches this code.\nAC:L - The attacker fully controls bpf load on device A, cls_bpf attach with SKIP_SW to device B, and deletion of device A, deterministically reproducing the offload teardown while the program remains referenced on device B.\nPR:L - RTNL TC filter operations require CAP_NET_ADMIN and BPF_PROG_TYPE_SCHED_CLS loading requires CAP_NET_ADMIN (and often CAP_BPF), all grantable to the namespace root created by an unprivileged user via unshare -Urn per kernel CNA guidance.\nUI:N - No victim interaction is required; the attacker performs bpf program load, cls_bpf attach, and netdev deletion through their own namespace-local administrative operations.\nS:U - Impact is kernel memory corruption, panic, or privilege escalation within the same host kernel and does not cross VM, container, or IOMMU boundaries into a separate security authority.\nC:H - Deleting the bound netdev destroys bpf offload private state while cls_bpf on another device still holds the program reference, freeing dev_private metadata and creating a use-after-free that can leak kernel heap contents on subsequent TC/BPF operations.\nI:H - The lifetime mismatch frees attacker-influenceable offload objects while references remain, enabling heap grooming and memory corruption that can be leveraged into arbitrary kernel writes or code execution.\nA:H - netdevsim WARNs when offload state is destroyed while the program remains loaded on another port, causing kernel panic on systems with panic_on_warn enabled, and dereferencing freed offload state can also trigger kernel oops or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:00:58.564Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ec5a552f4b2d841c6c021752450716e1a9676661"
        },
        {
          "url": "https://git.kernel.org/stable/c/daf546ab5763ce6a18280cb4db060e836c515301"
        },
        {
          "url": "https://git.kernel.org/stable/c/adb3e7c26a51a10d94a241c6de7a81a2863dcacf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5685bbbd3cbfbeb0de96a1d275a5ca073dfebb5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/120977e2c096deea4e866e4273be9220b957c29e"
        }
      ],
      "title": "net/sched: cls_bpf: reject dev-bound programs bound to a different device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74736",
    "datePublished": "2026-08-26T14:36:49.950Z",
    "dateReserved": "2026-08-15T05:44:03.930Z",
    "dateUpdated": "2026-08-27T05:00:58.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74736",
      "date": "2026-09-16",
      "epss": "0.00138",
      "percentile": "0.03541"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:06:26.000Z",
      "cve": "CVE-2026-74736",
      "id": "msrc_CVE-2026-74736",
      "initial_release_date": "2026-08-27T01:06:26.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: cls_bpf: reject dev-bound programs bound to a different device",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74736.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74736\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:16:52.173\",\"lastModified\":\"2026-08-27T06:17:22.650\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: cls_bpf: reject dev-bound programs bound to a different device\\n\\ncls_bpf_prog_from_efd() obtained a SCHED_CLS program via\\nbpf_prog_get_type_dev() but never verified that a device-bound (offloaded)\\nprogram\u0027s bound netdev matches the TC netdev the classifier is being\\nattached to. This let a program loaded with prog_ifindex for device A be\\nattached via cls_bpf + skip_sw to device B; deleting device A then\\ndestroyed the program\u0027s offload state while it was still attached to\\ndevice B, triggering a netdevsim WARN (panic with panic_on_warn=1).\\n\\nMirror the XDP attach path (net/core/dev.c) and reject the attach with\\n-EINVAL when a dev-bound program\u0027s bound device does not match the\\ntarget device.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/cls_bpf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"ec5a552f4b2d841c6c021752450716e1a9676661\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"daf546ab5763ce6a18280cb4db060e836c515301\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"adb3e7c26a51a10d94a241c6de7a81a2863dcacf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"5685bbbd3cbfbeb0de96a1d275a5ca073dfebb5e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b3486bc2d237ec345b3942b7be5deabf8c8fed1\",\"lessThan\":\"120977e2c096deea4e866e4273be9220b957c29e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/cls_bpf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/120977e2c096deea4e866e4273be9220b957c29e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5685bbbd3cbfbeb0de96a1d275a5ca073dfebb5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/adb3e7c26a51a10d94a241c6de7a81a2863dcacf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/daf546ab5763ce6a18280cb4db060e836c515301\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec5a552f4b2d841c6c021752450716e1a9676661\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T08:56:53+00:00",
      "cve": "CVE-2026-74736",
      "id": "CVE-2026-74736",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: cls_bpf: reject dev-bound programs bound to a different device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74736.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:15:30Z",
      "cve": "CVE-2026-74736",
      "id": "CVE-2026-74736",
      "initial_release_date": "2026-08-27T00:21:33Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74736",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74736.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.