CVE-2026-74544

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds<br /> <br /> u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,<br /> 0-255) into the kernel knode object without bounds validation. When a<br /> packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates<br /> `ntohs(offmask &amp; *data) &gt;&gt; offshift` where the left operand is a 16-bit<br /> value promoted to a 32-bit int. Any offshift &gt;= 32 is undefined behavior<br /> per C11 6.5.7p3, triggerable by an unprivileged user via user/network<br /> namespaces.<br /> <br /> UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43<br /> shift exponent 32 is too large for 32-bit type int<br /> <br /> Fix this by rejecting offshift &gt;= 16 during filter creation in<br /> u32_change().