CVE-2026-74736
Received Received - Intake

cls_bpf Program Device Mismatch in Linux Kernel

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1). Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74736
EUVD
EUVD-2026-66566

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the cls_bpf traffic control classifier. It allows a BPF program bound to one network device to be incorrectly attached to a different device. When the original device is deleted, the program's offload state is destroyed while still attached elsewhere, potentially causing a kernel warning or panic.

Impact Analysis

If exploited, this could lead to system instability, crashes, or denial of service by triggering kernel panics. It may also allow unauthorized network traffic manipulation if an attacker gains control of a misconfigured BPF program.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-74736. Avoid using cls_bpf with device-bound BPF programs until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart