CVE-2026-74739

In the Linux kernel, the following vulnerability has been resolved:

net/sched: clsu32: skip hash tables in u32bind_class()

u32walk() enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass() unconditionally casts the passed fh to tcuknode and accesses &n->res, so when fh is actually a tcuhnode, which has no tcfresult member, this results in a slab-out-of-bounds read of res->classid in tcclsbind_class().

The issue can be reproduced with the following commands:

tc qdisc add dev lo root handle 1: hfsc
tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit
tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1
tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit

Fix this by skipping hash tables via the TCU32KEY(handle) check.