HIGH Introduced in 6.3
cls_bpf DevBound UAF
CVE-2026-74736
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1). Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.
02KernelScan AI Analysis
Risk summary
A missing device-match validation in the TC BPF classifier allows a device-bound BPF program to be attached to a different network device. Deleting the originally bound device frees offload state still in use, causing a use-after-free that can crash or corrupt the kernel. Unprivileged users with user-namespace access can obtain the required capabilities to trigger this.
Vulnerability analysis
A BPF program loaded as device-bound to one network interface could be attached as a TC classifier on a different interface without any validation. When the originally bound interface is later removed, the kernel destroys the program's hardware offload state while it is still actively referenced by the other interface's classifier, resulting in a use-after-free that can crash the kernel. The fix adds a device-match check at attach time, rejecting the operation with an error if the program's bound device differs from the target device, mirroring the existing validation in the XDP attach path. The vulnerable path is reachable locally via netlink TC configuration by any user who can obtain CAP_NET_ADMIN and BPF loading privileges, including unprivileged users inside a user namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.3 | 6.12.105 | daf546ab5763 |
| 6.18 | 6.3 | 6.18.46 | adb3e7c26a51 |
| 6.6 | 6.3 | 6.6.153 | ec5a552f4b2d |
| 7.1 | 6.3 | 7.1.10 | 5685bbbd3cbf |
| mainline | 6.3 | 7.2 | 120977e2c096 |
| cip/6.12 | 6.3 | 6.12.108-cip31 | daf546ab5763 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |