CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved:
net/sched: clsu32: validate offshift to prevent shift-out-of-bounds
u32change() copies the user-provided tcu32sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32classify() with TCU32VAROFFSET set, it evaluates ntohs(offmask & data) >> offshift where the left operand is a 16-bit value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior per C11 6.5.7p3, triggerable by an unprivileged user via user/network namespaces.
UBSAN: shift-out-of-bounds in net/sched/clsu32.c:236:43 shift exponent 32 is too large for 32-bit type int
Fix this by rejecting offshift >= 16 during filter creation in u32change().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.8 - Configuration
Update u32_change() to reject tc_u32_sel.offshift values of 16 or greater when creating a filter.
Linux kernel net/sched cls_u32 offshift validation in u32_change() = Reject offshift >= 16 during filter creation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74544?
CVE-2026-74544 has a risk level of 37, indicating a significant vulnerability in the Linux kernel.
How do I fix CVE-2026-74544?
To fix CVE-2026-74544, update your Linux kernel to the latest version that includes the necessary patch.
What does CVE-2026-74544 affect?
CVE-2026-74544 affects the Linux kernel's network scheduling component, specifically the cls_u32 class.
What type of vulnerability is CVE-2026-74544?
CVE-2026-74544 is an input validation vulnerability that can lead to shift-out-of-bounds issues.
When was CVE-2026-74544 published?
CVE-2026-74544 was published on August 15, 2026.