https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:24:46 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74736 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: cls_bpf: reject dev-bound programs bound to a different device</p> <p>cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program&#39;s bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program&#39;s offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1).</p> <p>Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program&#39;s bound device does not match the target device.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: cls_bpf: reject dev-bound programs bound to a different device</p> <p>cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program&#39;s bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program&#39;s offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1).</p> <p>Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program&#39;s bound device does not match the target device.</p> https://vulnerability.circl.lu/vuln/cve-2026-74736