CVE-2026-74544

A flaw was found in the Linux kernel's cls_u32 module. An unprivileged user, through user or network namespaces, could provide a specially crafted offshift value that is not properly validated. This improper validation leads to a shift-out-of-bounds condition, resulting in undefined behavior and potentially causing a denial of service or system instability.

A shift-out-of-bounds bug in cls_u32 can occur because the user controlled tc_u32 offshift value was accepted without a bounds check and later used by u32_classify() when TC_U32_VAROFFSET is set. A local user who can create tc u32 filters can choose an invalid offshift and then send traffic through the classifier to trigger undefined shift behavior and a UBSAN report. For the CVSS the PR:L is used because reliable triggering requires local code or a process with CAP_NET_ADMIN in a network namespace, which may be reachable by unprivileged users when user/network namespaces are enabled. The issue is not directly network reachable because remote traffic alone cannot install the malicious classifier. Impact is primarily denial of service via warning or kernel crash on systems configured to panic on UBSAN or warnings. No concrete UAF, OOB write, information leak, or privilege escalation primitive is evident from the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.