CVE-2026-74737 (GCVE-0-2026-74737)
Vulnerability from cvelistv5 – Published: 2026-08-26 14:36 – Updated: 2026-08-27 05:00
VLAI
EPSS
VEX
Title
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
On the packet reception path, the ID of the MAC Port on which the packet
was received, is embedded in the RX DMA Descriptor's metadata. The ID is
extracted using the helper function cppi5_desc_get_tags_ids() which fills
in the 16-bit Source Tag into the 'port_id' variable. However, it is only
the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,
while the upper 8-bits are Hardware-Reserved and carry an arbitrary value.
With the existing logic, sporadic kernel crash is observed due to the
subsequent driver code accessing out-of-bound memory because of an invalid
port_id.
Hence, fix the port_id extraction logic to use only the lower 8-bits of the
Source Tag as the MAC Port ID.
Severity
9.8 (Critical)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
93a76530316a3d8cc2d82c3deca48424fee92100 , < 14fc40bf28390e0ebee6a072457c36b82c614100
(git)
Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 1c0e35ce761131f82062222779d8574849790892 (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 9a220225efd6f58350bbb53fe70bdec08519267f (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 551688b410d3fb0dae7739724422f268cd9446d6 (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 46a8e084a159e638ac2728e96980b65d752d65fd (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3 (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 914e0100df3435bd14d09f397238e891cf9b7dce (git) Affected: 93a76530316a3d8cc2d82c3deca48424fee92100 , < 36a05d2820077bb3955acb8111e1041d39148037 (git) |
guessed | |
| Linux | Linux |
Affected:
5.7
Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ti/am65-cpsw-nuss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14fc40bf28390e0ebee6a072457c36b82c614100",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
},
{
"lessThan": "1c0e35ce761131f82062222779d8574849790892",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
},
{
"lessThan": "9a220225efd6f58350bbb53fe70bdec08519267f",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
},
{
"lessThan": "551688b410d3fb0dae7739724422f268cd9446d6",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
},
{
"lessThan": "46a8e084a159e638ac2728e96980b65d752d65fd",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
},
{
"lessThan": "72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
},
{
"lessThan": "914e0100df3435bd14d09f397238e891cf9b7dce",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
},
{
"lessThan": "36a05d2820077bb3955acb8111e1041d39148037",
"status": "affected",
"version": "93a76530316a3d8cc2d82c3deca48424fee92100",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ti/am65-cpsw-nuss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\n\nOn the packet reception path, the ID of the MAC Port on which the packet\nwas received, is embedded in the RX DMA Descriptor\u0027s metadata. The ID is\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\nin the 16-bit Source Tag into the \u0027port_id\u0027 variable. However, it is only\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\nWith the existing logic, sporadic kernel crash is observed due to the\nsubsequent driver code accessing out-of-bound memory because of an invalid\nport_id.\n\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\nSource Tag as the MAC Port ID."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in am65_cpsw_nuss_rx_packets() on the NAPI RX path for TI AM65/J721E CPSW Ethernet; any remote host that can deliver L2 frames to a configured port triggers RX DMA completion and this handler without local access.\nAC:L - An attacker only needs to send Ethernet traffic to drive RX completions; although hardware upper source-tag bits make hits sporadic, sustained transmission reliably provokes the out-of-bounds port lookup without races or victim-specific state.\nPR:N - Exploitation requires no Linux credentials or capabilities\u2014the vulnerable code runs in kernel RX softirq before socket demux or authentication, reachable by any entity that can send frames to the NIC.\nUI:N - Packet reception and NAPI polling are automatic once the interface is up; no victim mount, click, or other local action is needed beyond normal network connectivity to the device.\nS:U - Impact is kernel memory corruption and crash within the host kernel security domain; there is no VM, container, or IOMMU boundary crossover typical of Scope Changed scenarios.\nC:H - Invalid port_id indexes far past the kmalloc\u0027d ports[] array (max eight) via am65_common_get_port(), causing out-of-bounds reads of adjacent kernel objects such as ndev pointers, xdp_prog, and other port fields.\nI:H - The same out-of-bounds port pointer drives writes including ndev stats increments, XDP processing, and skb association on attacker-supplied packet buffers, yielding a memory corruption primitive steerable toward kernel modification.\nA:H - The fix commit documents sporadic kernel oops/panics from out-of-bounds access when hardware source-tag upper bits inflate port_id beyond the small allocated ports array."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:00:59.630Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100"
},
{
"url": "https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892"
},
{
"url": "https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f"
},
{
"url": "https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6"
},
{
"url": "https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd"
},
{
"url": "https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3"
},
{
"url": "https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce"
},
{
"url": "https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037"
}
],
"title": "net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74737",
"datePublished": "2026-08-26T14:36:50.544Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-08-27T05:00:59.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74737",
"date": "2026-08-27",
"epss": "0.00559",
"percentile": "0.44173"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74737\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:16:52.313\",\"lastModified\":\"2026-08-27T06:17:22.950\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\\n\\nOn the packet reception path, the ID of the MAC Port on which the packet\\nwas received, is embedded in the RX DMA Descriptor\u0027s metadata. The ID is\\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\\nin the 16-bit Source Tag into the \u0027port_id\u0027 variable. However, it is only\\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\\nWith the existing logic, sporadic kernel crash is observed due to the\\nsubsequent driver code accessing out-of-bound memory because of an invalid\\nport_id.\\n\\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\\nSource Tag as the MAC Port ID.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"14fc40bf28390e0ebee6a072457c36b82c614100\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"1c0e35ce761131f82062222779d8574849790892\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"9a220225efd6f58350bbb53fe70bdec08519267f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"551688b410d3fb0dae7739724422f268cd9446d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"46a8e084a159e638ac2728e96980b65d752d65fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"914e0100df3435bd14d09f397238e891cf9b7dce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a76530316a3d8cc2d82c3deca48424fee92100\",\"lessThan\":\"36a05d2820077bb3955acb8111e1041d39148037\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/ti/am65-cpsw-nuss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.266\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.217\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-27T11:00:03+00:00",
"cve": "CVE-2026-74737",
"id": "CVE-2026-74737",
"initial_release_date": "2026-08-26T00:00:00+00:00",
"product_status:known_affected": "76",
"product_status:known_not_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74737.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…