CVE-2026-74739

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's cls_u32 traffic control classifier, affecting the kernel and kernel-rt components in Red Hat Enterprise Linux 7 (ELS), 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS. The u32_bind_class() function unconditionally casts the handle passed by u32_walk() to a tc_u_knode and reads its tcf_result member; when the handle is actually a tc_u_hnode hash table, which has no tcf_result member, tc_cls_bind_class() performs a slab-out-of-bounds read of res->classid. A local attacker with network administration privileges (CAP_NET_ADMIN), for example through crafted tc commands that bind a class to a u32 filter, could exploit this flaw to cause a denial of service (kernel panic); the CVE description also notes a potential to disclose sensitive information. Red Hat rates this flaw as moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, availability impact only), which differs from the upstream CVEORG rating of 7.8 (important), because reliable triggering requires local access with traffic-control configuration privileges and the established consequence is a system crash rather than the high confidentiality and integrity impacts assumed upstream. The fix is deferred for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams; the residual risk is limited to a local denial of service or an out-of-bounds kernel memory read by an attacker who already holds network administration privileges on the system. The Red Hat Enterprise Linux 6 stream is out of support scope (OOSS).