CVE-2026-74739

A flaw was found in the Linux kernel's cls_u32 module, responsible for traffic control. This vulnerability occurs because the u32_bind_class() function incorrectly handles certain data structures, leading to a slab-out-of-bounds read. A local attacker with network administration capabilities could exploit this flaw to potentially cause a denial of service or disclose sensitive information.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's cls_u32 traffic control classifier, affecting the kernel and kernel-rt components in Red Hat Enterprise Linux 7 (ELS), 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS. The u32_bind_class() function unconditionally casts the handle passed by u32_walk() to a tc_u_knode and reads its tcf_result member; when the handle is actually a tc_u_hnode hash table, which has no tcf_result member, tc_cls_bind_class() performs a slab-out-of-bounds read of res->classid. A local attacker with network administration privileges (CAP_NET_ADMIN), for example through crafted tc commands that bind a class to a u32 filter, could exploit this flaw to cause a denial of service (kernel panic); the CVE description also notes a potential to disclose sensitive information. Red Hat rates this flaw as moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, availability impact only), which differs from the upstream CVEORG rating of 7.8 (important), because reliable triggering requires local access with traffic-control configuration privileges and the established consequence is a system crash rather than the high confidentiality and integrity impacts assumed upstream. The fix is deferred for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams; the residual risk is limited to a local denial of service or an out-of-bounds kernel memory read by an attacker who already holds network administration privileges on the system. The Red Hat Enterprise Linux 6 stream is out of support scope (OOSS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.