{"id":"CVE-2026-74290","summary":"net/sched: cls_flow: Dont expose folded kernel pointers","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flow: Dont expose folded kernel pointers\n\nThe flow classifier falls back to addr_fold() for fields that are missing\nfrom packet headers. In map mode, userspace controls mask, xor, rshift,\naddend and divisor, and can observe the resulting classid through class\nstatistics. This allows a tc classifier in a user/network namespace to\nrecover the 32-bit folded value of skb-\u003esk, skb_dst() or skb_nfct().\n\nAlign with standard kernel practices for pointer hashing and replace the\nXOR folding with a keyed siphash (which is cryptographically secure)","modified":"2026-08-18T03:31:11.290944823Z","published":"2026-08-15T05:57:57.004Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74290.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/19f2ecf8ea564562c7e7a919cf38068dd9aa1c96"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3d054001860270748405a3f9270c5fa0bf7ffc19"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6151159618198675e01c391676e579738286c135"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f294fc71c4a0fa4964f6428a1b4e7929c1d83125"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fb31fbe51c233f3bf47021121f63d2e42cac2d08"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74290.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74290"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e5dfb815181fcb186d6080ac3a091eadff2d98fe"},{"fixed":"19f2ecf8ea564562c7e7a919cf38068dd9aa1c96"},{"fixed":"3d054001860270748405a3f9270c5fa0bf7ffc19"},{"fixed":"fb31fbe51c233f3bf47021121f63d2e42cac2d08"},{"fixed":"0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a"},{"fixed":"6151159618198675e01c391676e579738286c135"},{"fixed":"f294fc71c4a0fa4964f6428a1b4e7929c1d83125"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74290.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.25"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74290.json"}}],"schema_version":"1.9.0"}