Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-74290

net/sched: cls_flow: Dont expose folded kernel pointers

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: Dont expose folded kernel pointers The flow classifier falls back to addr_fold() for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can observe the resulting classid through class statistics. This allows a tc classifier in a user/network namespace to recover the 32-bit folded value of skb->sk, skb_dst() or skb_nfct(). Align with standard kernel practices for pointer hashing and replace the XOR folding with a keyed siphash (which is cryptographically secure)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e5dfb815181fcb186d6080ac3a091eadff2d98fe to < 19f2ecf8ea564562c7e7a919cf38068dd9aa1c96affected
  • e5dfb815181fcb186d6080ac3a091eadff2d98fe to < 3d054001860270748405a3f9270c5fa0bf7ffc19affected
  • e5dfb815181fcb186d6080ac3a091eadff2d98fe to < fb31fbe51c233f3bf47021121f63d2e42cac2d08affected
  • e5dfb815181fcb186d6080ac3a091eadff2d98fe to < 0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577aaffected
  • e5dfb815181fcb186d6080ac3a091eadff2d98fe to < 6151159618198675e01c391676e579738286c135affected
  • e5dfb815181fcb186d6080ac3a091eadff2d98fe to < f294fc71c4a0fa4964f6428a1b4e7929c1d83125affected

Linux Linux

Default version status: affected

  • 2.6.25affected
  • 0 to < 2.6.25unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References