{"id":"AZL-96395","summary":"CVE-2026-74544 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: validate offshift to prevent shift-out-of-bounds\n\nu32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,\n0-255) into the kernel knode object without bounds validation. When a\npacket later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates\n`ntohs(offmask & *data) \u003e\u003e offshift` where the left operand is a 16-bit\nvalue promoted to a 32-bit int. Any offshift \u003e= 32 is undefined behavior\nper C11 6.5.7p3, triggerable by an unprivileged user via user/network\nnamespaces.\n\nUBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43\nshift exponent 32 is too large for 32-bit type int\n\nFix this by rejecting offshift \u003e= 16 during filter creation in\nu32_change().","modified":"2026-08-29T05:27:27Z","published":"2026-08-15T13:17:59Z","upstream":["CVE-2026-74544"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74544"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96395.json"}}],"schema_version":"1.9.0"}