CVE-2026-74382

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack overflow occurs in the cls bpf offload cmd() function. The issue arises during an offload rollback process when tc setup cb replace() fails. The function attempts to roll back by swapping prog and oldprog and recursively calling itself. If the rollback attempt fails again, it triggers another recursive call with the same arguments, leading to unbounded recursion and eventual stack exhaustion. This condition can be met by any driver where tc setup cb replace() fails twice consecutively.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.