Linux Kernel up to 7.1.7/7.2-rc5 cls_u32 net/sched/cls_u32.c u32_change offshift out-of-bounds

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.7/7.2-rc5. This issue affects the function u32_change of the file net/sched/cls_u32.c of the component cls_u32. Performing a manipulation of the argument offshift results in out-of-bounds. This vulnerability is reported as CVE-2026-74544. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.7/7.2-rc5. It has been classified as very critical. This affects the function u32_change of the file net/sched/cls_u32.c of the component cls_u32. The manipulation of the argument offshift with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates `ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior per C11 6.5.7p3, triggerable by an unprivileged user via user/network namespaces. UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43 shift exponent 32 is too large for 32-bit type int Fix this by rejecting offshift >= 16 during filter creation in u32_change().

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-74544 since 08/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/15/2026).

Upgrading to version 7.1.8 or 7.2-rc6 eliminates this vulnerability. Applying the patch 313cb9ffc4101a885d791facf4b5ea3d5e06144d/aef96eead2860cbfa371e4471d4f04412213b958 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4
• 7.2-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion