CVE-2026-74382

A flaw was found in the Linux kernel's cls_bpf component, which handles traffic control filtering. A local attacker could exploit this vulnerability by triggering a specific sequence of failures during an offload rollback operation. This leads to an unbounded recursion, causing a stack overflow and ultimately resulting in a denial of service (DoS) for the system.

A low impact denial of service flaw was found in the Linux kernel's traffic control BPF classifier (cls_bpf) offload handling. A local attacker with privileges to configure traffic control (for example CAP_NET_ADMIN) could trigger unbounded recursion in cls_bpf_offload_cmd(): when a hardware offload filter replace operation (tc filter replace on a skip_sw cls_bpf filter) fails, the function swaps programs and re-enters itself to roll back, and if the rollback attempt fails as well, the same rollback is retried until the kernel stack is exhausted, resulting in a system crash. Only availability is affected; there is no impact on confidentiality or integrity, and exploitation requires local privileged access, which is why Red Hat Product Security rates the impact of this flaw as low. Affected Red Hat Enterprise Linux kernel and kernel-rt streams and Red Hat In-Vehicle OS kernel streams are marked affected, while Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. Because this is a low severity denial of service issue, fixes for the affected streams are deferred to a future update; the residual risk is that a local privileged user can crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.