CVE-2026-74290 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_flow: Dont expose folded kernel pointers
The flow classifier falls back to addr_fold() for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can observe the resulting classid through class statistics. This allows a tc classifier in a user/network namespace to recover the 32-bit folded value of skb->sk, skb_dst() or skb_nfct().
Align with standard kernel practices for pointer hashing and replace the XOR folding with a keyed siphash (which is cryptographically secure)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's net/sched/cls_flow module represents a significant information disclosure risk that stems from improper handling of kernel pointers within network traffic classification mechanisms. This flaw exists in the flow classifier implementation where the system falls back to addr_fold() function for fields missing from packet headers, creating an avenue for adversaries to recover sensitive kernel memory addresses through carefully crafted traffic classification rules.
The technical implementation of this vulnerability occurs within the tc (traffic control) subsystem where userspace applications can configure classifiers using various parameters including mask, xor, rshift, addend, and divisor values. When packet headers lack certain fields, the classifier automatically falls back to address folding operations that expose folded kernel pointers through class statistics. This design flaw specifically affects skb->sk, skb_dst(), and skb_nfct kernel object pointers, which are commonly used in network packet processing contexts. The vulnerability allows attackers in user or network namespaces to observe 32-bit folded values that represent internal kernel memory locations.
The operational impact of this vulnerability extends beyond simple information disclosure as it provides attackers with valuable insights into kernel memory layout and structure. This information can be leveraged for more sophisticated exploitation techniques, including privilege escalation attempts and targeted attacks against kernel memory management. The exposure occurs through the class statistics interface where userspace can observe the resulting classid values that contain the folded pointer information. According to CWE-200, this represents an information disclosure vulnerability that directly impacts system security by revealing internal kernel structures.
The mitigation strategy for this vulnerability involves aligning with established kernel security practices and implementing cryptographically secure hashing mechanisms instead of the traditional XOR folding operations. The solution specifically recommends replacing the existing XOR-based folding approach with a keyed siphash implementation, which provides cryptographic security guarantees while maintaining the necessary functionality for traffic classification. This change addresses the fundamental flaw by ensuring that folded pointer values cannot be easily reversed or predicted, thus eliminating the information disclosure channel.
This vulnerability demonstrates the importance of proper kernel pointer handling and memory protection mechanisms within network subsystems, aligning with ATT&CK technique T1068 which covers local privilege escalation through kernel vulnerabilities. The fix directly addresses security concerns related to information disclosure in kernel space operations and follows established patterns for secure pointer obfuscation that are consistent with modern kernel security practices. The implementation of cryptographically secure hashing ensures that even if an attacker gains access to the folded values, they cannot derive meaningful information about the underlying kernel memory structures without the proper cryptographic keys.