CVE-2026-74736Patch

LOWCVSS 7.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1). Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Patch

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud46d
Patch
🚨*CVE* CVE-2026-74736 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd(… https://www.cve.org/CVERecord?id=CVE-2026-74736 ----- Traducción: CVE-2026-74736 En … https://infoflow.cloud`
Post summary
The post announces that CVE‑2026‑74736, a Linux kernel cls_bpf vulnerability, has been fixed, providing brief technical details but no proof‑of‑concept, exploit, or evidence of active exploitation.
0000030
102 followersView on X
CVE@CVEnew46d
Patch
CVE-2026-74736 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd(… https://www.cve.org/CVERecord?id=CVE-2026-74736
Post summary
CVE-2026-74736, a Linux kernel cls_bpf issue, has been fixed and technical details are provided, with no evidence of PoC, exploit code, or active exploitation.
000001.1K
58.0K followersView on X

Explore more

Back to dashboard