CVE-2026-74736

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the cls bpf prog from efd() function where it fails to verify if a device-bound offloaded program's bound network device matches the TC network device it is being attached to. This allows a program loaded with a prog ifindex for one device to be attached to a different device via cls bpf and skip sw. If the original device is deleted, the program's offload state is destroyed while still attached to the second device, which can trigger a netdevsim warning or a system panic if panic on warn is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.