Shift-Out-Of-Bounds Vulnerability in Linux Kernel Affects Network Scheduling

CVE-2026-74544

What is CVE-2026-74544?

In the Linux kernel's network scheduling component, a vulnerability exists due to lack of bounds validation when copying user-provided data. Specifically, the function u32_change() does not properly validate the 'offshift' value, allowing unprivileged users to trigger undefined behavior when packets are classified. This can lead to potential security implications if exploited, as it allows for manipulation in a way that may affect kernel execution. The vulnerability has been addressed by enforcing validation to reject 'offshift' values greater than or equal to 16 during filter creation.

References