Executive brief
The Linux kernel's traffic control (TC) classifier uses eBPF programs to filter network traffic. A validation flaw allowed attackers to attach an eBPF program designed for one network device to another device by bypassing device binding checks. When the original device was deleted, the misattached program's offloaded state would be corrupted, causing system instability or crashes.
Technical details
The vulnerability exists in the cls_bpf_prog_from_efd() function in net/sched/cls_bpf.c. When loading a device-bound (offloaded) eBPF program via the TC classifier, the function failed to verify that the program's bound network device matched the target device. An attacker with local privileges could attach a program bound to device A to device B using cls_bpf with skip_sw flag. When device A was subsequently deleted, its offload state was destroyed while still attached to device B, triggering kernel warnings or panics. The fix adds a check using bpf_prog_is_dev_bound() and bpf_offload_dev_match() to reject such mismatched attachments with -EINVAL, mirroring the validation used in the XDP attach path.
Affected products
- Linux Linux kernel multiple versions prior to 2026-08-13
Timeline
- 2026-08-26: disclosed: CVE-2026-74736 published
- 2026-08-13: patched: Upstream fix merged by Paolo Abeni
- 2026-08-23: patched: Fix included in stable kernels