---
id: CVE-2026-74739
title: 'net/sched: cls_u32: skip hash tables in u32_bind_class()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: cls_u32: skip hash tables in u32_bind_class()

  u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode
  through the walker callback. u32_bind_class…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 <
    ec5f3005586a785689fd568361b0c5925cb1548b
  - >-
    Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 <
    19d114b93c94bdef70496f26685c2a6b242f41b3
  - >-
    Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 <
    594a064d603202b9ee21e07679d854e5c1750cc4
  - >-
    Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 <
    31f26a95eeee926946809ac456c61a3217936a62
  - >-
    Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 <
    e71f8e9ed6f311410b14741f6012afe01869c0fa
  - >-
    Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 <
    6d3724e616faf952c3adcf8414fc21a828ef3709
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:15:59.810780Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:16:12.856Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74739'
references:
  - url: 'https://git.kernel.org/stable/c/ec5f3005586a785689fd568361b0c5925cb1548b'
  - url: 'https://git.kernel.org/stable/c/19d114b93c94bdef70496f26685c2a6b242f41b3'
  - url: 'https://git.kernel.org/stable/c/594a064d603202b9ee21e07679d854e5c1750cc4'
  - url: 'https://git.kernel.org/stable/c/31f26a95eeee926946809ac456c61a3217936a62'
  - url: 'https://git.kernel.org/stable/c/e71f8e9ed6f311410b14741f6012afe01869c0fa'
  - url: 'https://git.kernel.org/stable/c/6d3724e616faf952c3adcf8414fc21a828ef3709'
tags:
  - cve.org
epss: 0.00139
epssPercentile: 0.02893
ingestedAt: '2026-10-16T19:46:24.327Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: skip hash tables in u32_bind_class()

u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode
through the walker callback. u32_bind_class() unconditionally casts the
passed fh to tc_u_knode and accesses &n->res, so when fh is actually a
tc_u_hnode, which has no tcf_result member, this results in a
slab-out-of-bounds read of res->classid in tc_cls_bind_class().

The issue can be reproduced with the following commands:

    tc qdisc add dev lo root handle 1: hfsc
    tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit
    tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1
    tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit

Fix this by skipping hash tables via the TC_U32_KEY(handle) check.

## Affected

- `Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 < ec5f3005586a785689fd568361b0c5925cb1548b`
- `Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 < 19d114b93c94bdef70496f26685c2a6b242f41b3`
- `Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 < 594a064d603202b9ee21e07679d854e5c1750cc4`
- `Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 < 31f26a95eeee926946809ac456c61a3217936a62`
- `Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 < e71f8e9ed6f311410b14741f6012afe01869c0fa`
- `Linux >= 07d79fc7d94e3f884b8b1c95aa615b202bb5e4c1 < 6d3724e616faf952c3adcf8414fc21a828ef3709`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.