CVE-2026-74544

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the cls u32 component where the u32 change() function copies a user-provided tc u32 sel.offshift value into a kernel knode object without proper bounds validation. When a packet is processed by u32 classify() with TC U32 VAROFFSET set, the system performs a right-shift operation using the offshift variable. If offshift is 32 or greater, it results in undefined behavior because the shift exponent exceeds the size of the 32-bit integer type. This condition can be triggered by an unprivileged user through user or network namespaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.