CVE-2026-74736: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74736 Overview

CVE-2026-74736 is a Linux kernel vulnerability in the net/sched subsystem, specifically the cls_bpf classifier. The function cls_bpf_prog_from_efd() retrieved a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matched the traffic control (TC) netdev to which the classifier was being attached. An attacker with local privileges to load BPF programs and configure TC can attach a program bound to device A onto device B using skip_sw. Deleting device A then destroys the program's offload state while it remains attached to device B, triggering a netdevsim warning and a kernel panic when panic_on_warn=1 is set.

Critical Impact
Local attackers with BPF and network configuration privileges can trigger kernel state corruption and denial of service on systems using device-bound BPF programs with TC offload.

Affected Products

Linux kernel (upstream, mainline)
Linux kernel stable branches receiving the referenced backports
Systems using cls_bpf classifier with device-bound (offloaded) BPF programs

Discovery Timeline

2026-08-26 - CVE-2026-74736 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74736

Vulnerability Analysis

The vulnerability resides in the cls_bpf traffic classifier within the Linux kernel networking stack. When a BPF program is loaded with prog_ifindex set, the kernel marks it as device-bound (offloaded) to a specific netdev. The cls_bpf_prog_from_efd() helper fetched such a program via bpf_prog_get_type_dev() but omitted the check that the program's bound device matches the TC netdev used at attach time.

This missing validation allows a program bound to device A to be attached with skip_sw semantics to device B. Because skip_sw requires hardware offload, the kernel treats the attachment as offloaded, yet the program's offload state remains tied to device A. When device A is removed, the offload teardown path destroys the program's state while it is still referenced by the classifier on device B. Subsequent classifier operations trigger a netdevsimWARN, which becomes a kernel panic if panic_on_warn is enabled.

Root Cause

The root cause is a missing consistency check between a BPF program's bound netdev and the target netdev during cls_bpf attachment. The XDP attach path in net/core/dev.c already enforces this invariant, but cls_bpf did not mirror the check, producing an improper access control condition over kernel offload state.

Attack Vector

Exploitation requires local access with CAP_NET_ADMIN and CAP_BPF (or CAP_SYS_ADMIN on older kernels). The attacker loads a SCHED_CLS program with prog_ifindex pointing to device A, attaches it via tc filter add ... bpf ... skip_sw on device B, and then removes device A. The dangling offload state produces kernel instability. No verified public exploit code is available. See the referenced upstream commits for the corrective validation logic.

Detection Methods for CVE-2026-74736

Indicators of Compromise

Kernel WARN messages originating from netdevsim or the cls_bpf offload path in dmesg and system logs.
Unexpected kernel panics on hosts with panic_on_warn=1 following network device teardown.
tc filter entries referencing BPF programs whose bound ifindex differs from the classifier's netdev.

Detection Strategies

Audit BPF program metadata via bpftool prog show and correlate the dev field with tc filter show dev <iface> output to flag mismatched attachments.
Monitor kernel ring buffer for warnings referencing cls_bpf, netdevsim, or bpf_offload around netdev removal events.
Track invocations of TC_SETUP_CLSBPF with skip_sw flags in eBPF tracing to identify anomalous offload attachments.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a central logging platform and alert on WARN_ON traces in networking subsystems.
Baseline expected TC classifier configurations across managed hosts and alert on deviations, particularly skip_sw usage on virtual devices.
Instrument audit rules for bpf() and tc syscall usage by non-root or newly privileged accounts.

How to Mitigate CVE-2026-74736

Immediate Actions Required

Apply the upstream kernel patches referenced below or update to a stable kernel release that includes the fix.
Restrict CAP_BPF, CAP_NET_ADMIN, and CAP_SYS_ADMIN to trusted service accounts; remove these capabilities from general workloads and containers.
Disable panic_on_warn on production hosts where availability is critical, while treating any WARN from networking code as an incident.

Patch Information

The fix mirrors the XDP attach path by returning -EINVAL in cls_bpf_prog_from_efd() when a device-bound program's bound device does not match the target device. Corrective commits are available at Linux Kernel Commit 120977e, Linux Kernel Commit 5685bbb, Linux Kernel Commit adb3e7c, Linux Kernel Commit daf546a, and Linux Kernel Commit ec5a552.

Workarounds

Avoid using device-bound BPF programs with cls_bpf and skip_sw until patched kernels are deployed.
Constrain container and workload permissions using seccomp and Linux Security Modules to block the bpf() syscall where not required.
Where possible, unload the netdevsim module on production hosts to reduce the panic surface tied to this specific WARN path.

bash

# Verify kernel version and BPF-capable capabilities on hosts
uname -r
getcap -r / 2>/dev/null | grep -E 'cap_bpf|cap_net_admin|cap_sys_admin'

# Enumerate device-bound BPF programs and TC filters for review
bpftool prog show
tc filter show dev <interface>