Look up another CVE · open CVE-2026-74736 in the interactive tracker
CVE-2026-74736
net/sched: cls_bpf: reject dev-bound programs bound to a different device
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem net/sched. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74736 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1). Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/sched/cls_bpf.c
- What this is
- BPF [GENERAL] (Safe Dynamic Programs and Tools)MAINTAINERS section matched on net/sched/cls_bpf.c · bpf@vger.kernel.org · Supported
- Kernel module
- cls_bpf
Check it on the machine
grep -w CONFIG_NET_CLS_BPF /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cls_bpfPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_NET_CLS_BPF
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/sched
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.3 | 6.6.153 | ec5a552f4b2d |
| 6.3 | 6.12.105 | daf546ab5763 |
| 6.3 | 6.18.46 | adb3e7c26a51 |
| 6.3 | 7.1.10 | 5685bbbd3cbf |
| 6.3 | 7.2 | 120977e2c096 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires local RTM_NEWTFILTER and bpf(2) syscalls to misattach a dev-bound cls_bpf program and delete the bound netdev; received network packets are not the trigger and no remote pre-auth path reaches this code.
- AC:LAttack complexity, low
- The attacker fully controls bpf load on device A, cls_bpf attach with SKIP_SW to device B, and deletion of device A, deterministically reproducing the offload teardown while the program remains referenced on device B.
- PR:LPrivileges required, low
- RTNL TC filter operations require CAP_NET_ADMIN and BPF_PROG_TYPE_SCHED_CLS loading requires CAP_NET_ADMIN (and often CAP_BPF), all grantable to the namespace root created by an unprivileged user via unshare -Urn per kernel CNA guidance.
- UI:NUser interaction, none
- No victim interaction is required; the attacker performs bpf program load, cls_bpf attach, and netdev deletion through their own namespace-local administrative operations.
- S:UScope, unchanged
- Impact is kernel memory corruption, panic, or privilege escalation within the same host kernel and does not cross VM, container, or IOMMU boundaries into a separate security authority.
- C:HConfidentiality impact, high
- Deleting the bound netdev destroys bpf offload private state while cls_bpf on another device still holds the program reference, freeing dev_private metadata and creating a use-after-free that can leak kernel heap contents on subsequent TC/BPF operations.
- I:HIntegrity impact, high
- The lifetime mismatch frees attacker-influenceable offload objects while references remain, enabling heap grooming and memory corruption that can be leveraged into arbitrary kernel writes or code execution.
- A:HAvailability impact, high
- netdevsim WARNs when offload state is destroyed while the program remains loaded on another port, causing kernel panic on systems with panic_on_warn enabled, and dereferencing freed offload state can also trigger kernel oops or hang.