AZL-97767
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97767.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-97767
- Upstream
- Published
- 2026-08-26T15:16:52Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-74736 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_bpf: reject dev-bound programs bound to a different device
clsbpfprogfromefd() obtained a SCHEDCLS program via bpfproggettypedev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with progifindex for device A be attached via clsbpf + skipsw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with paniconwarn=1).
Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.
- References