CVE-2026-74736

A flaw was found in the Linux kernel's cls_bpf component. A device-bound program could be incorrectly attached to a different network device than it was intended for. This misconfiguration could allow an attacker to trigger a system panic, leading to a denial of service, if the original device is removed while the program remains active on the other device.

A flaw in the Linux kernel's traffic control BPF classifier (net/sched cls_bpf) has been rated Moderate by Red Hat Product Security. When obtaining a SCHED_CLS BPF program, cls_bpf_prog_from_efd() did not verify that a device-bound (offloaded) program's bound network device matches the network device the classifier is being attached to. As a result, a local attacker with sufficient privileges to load BPF programs and manage traffic control (for example CAP_NET_ADMIN) could load a device-bound program for one network device and attach it, via cls_bpf with skip_sw, to a different device. Deleting the originally bound device then destroys the program's offload state while it is still attached to the other device, triggering a kernel WARN that becomes a system panic when panic_on_warn is enabled, resulting in a denial of service. No impact to confidentiality or integrity is indicated by the upstream fix.

Red Hat Enterprise Linux 9 (kernel and kernel-rt, from the 9.4 streams onward), Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 are affected, and fixes for these streams are currently deferred to a future update; the residual risk is that a local privileged user can crash systems that use offloaded cls_bpf classifiers. Red Hat Enterprise Linux 6, 7, 8, and RHEL 9.2 are not affected because the vulnerable device-bound BPF program functionality is not present in those streams. The Red Hat severity of Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) differs from the upstream CVE.org score of 7.8 (Important) because exploitation requires local privileged access and only availability is impacted, with no evidence in the upstream fix of the confidentiality or integrity impact assumed by the upstream scoring.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.