Bug 2517014 (CVE-2026-74544)

Summary: CVE-2026-74544 kernel: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `cls_u32` module. An unprivileged user, through user or network namespaces, could provide a specially crafted `offshift` value that is not properly validated. This improper validation leads to a shift-out-of-bounds condition, resulting in undefined behavior and potentially causing a denial of service or system instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:44:58 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,
0-255) into the kernel knode object without bounds validation. When a
packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates
`ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit
value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior
per C11 6.5.7p3, triggerable by an unprivileged user via user/network
namespaces.

UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43
shift exponent 32 is too large for 32-bit type int

Fix this by rejecting offshift >= 16 during filter creation in
u32_change().
Comment 1 Mauro Matteo Cascella 2026-08-21 08:01:24 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081549-CVE-2026-74544-2dcd@gregkh/T