CVE-2026-74739

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds read occurs in the tc cls bind class() function. This happens because u32 bind class() unconditionally casts a passed fh to tc u knode and accesses &n->res. When fh is actually a tc u hnode, which lacks a tcf result member, the system reads res->classid outside the allocated slab memory. This issue is triggered during the enumeration of struct tc u hnode and struct tc u knode via the u32 walk() walker callback.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.