CVE-2026-74382
Description
A flaw was found in the Linux kernel's cls_bpf component, which handles traffic control filtering. A local attacker could exploit this vulnerability by triggering a specific sequence of failures during an offload rollback operation. This leads to an unbounded recursion, causing a stack overflow and ultimately resulting in a denial of service (DoS) for the system.
Statement
A low impact denial of service flaw was found in the Linux kernel's traffic control BPF classifier (cls_bpf) offload handling. A local attacker with privileges to configure traffic control (for example CAP_NET_ADMIN) could trigger unbounded recursion in cls_bpf_offload_cmd(): when a hardware offload filter replace operation (tc filter replace on a skip_sw cls_bpf filter) fails, the function swaps programs and re-enters itself to roll back, and if the rollback attempt fails as well, the same rollback is retried until the kernel stack is exhausted, resulting in a system crash. Only availability is affected; there is no impact on confidentiality or integrity, and exploitation requires local privileged access, which is why Red Hat Product Security rates the impact of this flaw as low. Affected Red Hat Enterprise Linux kernel and kernel-rt streams and Red Hat In-Vehicle OS kernel streams are marked affected, while Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. Because this is a low severity denial of service issue, fixes for the affected streams are deferred to a future update; the residual risk is that a local privileged user can crash the system.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
