CVE-2026-74739

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: cls_u32: skip hash tables in u32_bind_class()<br /> <br /> u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode<br /> through the walker callback. u32_bind_class() unconditionally casts the<br /> passed fh to tc_u_knode and accesses &amp;n-&gt;res, so when fh is actually a<br /> tc_u_hnode, which has no tcf_result member, this results in a<br /> slab-out-of-bounds read of res-&gt;classid in tc_cls_bind_class().<br /> <br /> The issue can be reproduced with the following commands:<br /> <br /> tc qdisc add dev lo root handle 1: hfsc<br /> tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit<br /> tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1<br /> tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit<br /> <br /> Fix this by skipping hash tables via the TC_U32_KEY(handle) check.