CVE-2026-74737

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG<br /> <br /> On the packet reception path, the ID of the MAC Port on which the packet<br /> was received, is embedded in the RX DMA Descriptor&amp;#39;s metadata. The ID is<br /> extracted using the helper function cppi5_desc_get_tags_ids() which fills<br /> in the 16-bit Source Tag into the &amp;#39;port_id&amp;#39; variable. However, it is only<br /> the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,<br /> while the upper 8-bits are Hardware-Reserved and carry an arbitrary value.<br /> With the existing logic, sporadic kernel crash is observed due to the<br /> subsequent driver code accessing out-of-bound memory because of an invalid<br /> port_id.<br /> <br /> Hence, fix the port_id extraction logic to use only the lower 8-bits of the<br /> Source Tag as the MAC Port ID.