CVE-2026-74737: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74737 Overview

CVE-2026-74737 is a Linux kernel vulnerability in the Texas Instruments AM65 Common Platform Switch (CPSW) NUSS Ethernet driver (am65-cpsw-nuss). The flaw resides in the packet reception path, where the driver extracts a MAC Port ID from the Source Tag field embedded in the RX DMA descriptor metadata. The helper cppi5_desc_get_tags_ids() returns the full 16-bit Source Tag, but only the lower 8 bits represent a valid port identifier. The upper 8 bits are hardware-reserved and can carry arbitrary values, producing an invalid port_id that leads to out-of-bounds memory access and sporadic kernel crashes.

Critical Impact
An invalid port_id derived from unsanitized hardware metadata drives out-of-bounds memory access in kernel context, resulting in kernel crashes and potential denial-of-service on TI AM65 CPSW-based systems.

Affected Products

Linux kernel builds including the am65-cpsw-nuss driver on Texas Instruments AM65-family SoCs
Kernel branches receiving the fix commits 14fc40b, 1c0e35c, 36a05d2, 46a8e08, 551688b, 72e4e3d, 914e010, and 9a22022
Networking stacks relying on the CPSW MAC Port ID for multi-port switch forwarding

Discovery Timeline

2026-08-26 - CVE-2026-74737 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74737

Vulnerability Analysis

The am65-cpsw-nuss driver reads packet metadata from the RX DMA descriptor to identify which physical MAC port received a frame. The helper cppi5_desc_get_tags_ids() stores the 16-bit Source Tag into a port_id variable used to index driver structures downstream. Because the upper 8 bits are hardware-reserved and undefined, the composite value can exceed the valid port index range. Subsequent code paths dereference structures indexed by that value, producing out-of-bounds reads and sporadic kernel panics. The fix masks the Source Tag to the lower 8 bits before use, ensuring port_id remains within the driver's port array bounds.

Root Cause

The root cause is improper input validation of hardware-supplied metadata. The driver assumed the full 16-bit Source Tag represented the MAC Port ID, but only bits 0-7 carry that identifier. Bits 8-15 are reserved hardware bits that carry unpredictable values, so passing the raw tag downstream causes the driver to compute an invalid port index. This behavior aligns with [CWE-125] Out-of-Bounds Read triggered by missing sanitization at a trust boundary between hardware DMA metadata and kernel-space consumers.

Attack Vector

The attacker vector is the network receive path. Any packet ingested through the CPSW peripheral triggers descriptor parsing, so an invalid port_id can surface during normal traffic handling. Frequent or crafted traffic that exercises the reception path increases the probability of the driver observing a non-zero upper byte in the Source Tag, resulting in an unstable port index and kernel-side memory corruption or crash. The vulnerability manifests without authentication or user interaction because it lives in the packet ingress path.

Refer to the upstream fixes for the exact single-line masking correction: Kernel Commit 46a8e08 and Kernel Commit 914e010.

Detection Methods for CVE-2026-74737

Indicators of Compromise

Kernel oops or panic messages referencing am65_cpsw symbols in the RX path, such as am65_cpsw_nuss_rx_packets or am65_cpsw_nuss_rx_handler
Sporadic device resets, network interface flaps, or NAPI stalls on TI AM65-family Ethernet interfaces
Out-of-bounds access reports from KASAN builds tagged to CPSW receive descriptors

Detection Strategies

Ingest kernel logs into centralized logging and alert on oops, BUG:, and KASAN entries that reference CPSW driver functions
Correlate NIC counter anomalies (packet drops, RX errors) on TI AM65 systems with kernel warning events across the fleet
Track kernel version and driver commit hash on embedded and edge devices to identify unpatched hosts running vulnerable am65-cpsw-nuss

Monitoring Recommendations

Monitor dmesg and /var/log/kern.log for CPSW-related stack traces and forward to a SIEM for correlation
Enable crash-dump collection (kdump) on AM65 platforms so post-mortem analysis can confirm the crash originated in the RX descriptor path
Track uptime and unplanned reboot events on impacted edge devices; regressions after network load are a signal to inspect the driver version

How to Mitigate CVE-2026-74737

Immediate Actions Required

Inventory Linux systems running the am65-cpsw-nuss driver on Texas Instruments AM65 SoCs
Update kernels to a stable release that includes the port_id masking fix referenced by the upstream commits
Rebuild and redeploy custom or vendor-specific kernels for embedded devices with the patched driver source

Patch Information

The fix restricts port_id extraction to the lower 8 bits of the Source Tag. Backports have landed across multiple stable trees. See the upstream commits: Kernel Commit 14fc40b, Kernel Commit 1c0e35c, Kernel Commit 36a05d2, Kernel Commit 46a8e08, Kernel Commit 551688b, Kernel Commit 72e4e3d, Kernel Commit 914e010, and Kernel Commit 9a22022.

Workarounds

Restrict exposure of affected AM65 interfaces to trusted L2 segments while patches roll out to reduce packet volume traversing the vulnerable path
Where operationally feasible, disable unused CPSW ports to shrink the affected surface until firmware and kernel updates are deployed
Enable kdump and watchdog-driven auto-recovery to reduce mean time to recovery on devices that cannot be patched immediately

bash

# Verify running kernel version and CPSW driver on an AM65 host
uname -r
modinfo am65_cpsw_nuss | grep -E 'filename|version|srcversion'
dmesg | grep -i 'am65_cpsw\|cpsw-nuss'