Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device… (CVE-2026-74736)

The Linux kernel vulnerability CVE-2026-74736 involved the cls_bpf classifier in the net/sched subsystem. The function cls_bpf_prog_from_efd() obtained a SCHED_CLS BPF program via bpf_prog_get_type_dev() but did not verify that the device-bound program's associated network device matched the device to which the classifier was being attached. This allowed a program loaded for device A to be attached to device B using cls_bpf with skip_sw. If device A was deleted, the program's offload state was destroyed while still attached to device B, triggering a netdevsim warning and potentially causing a kernel panic if panic_on_warn was enabled. The fix mirrors the XDP attach path by rejecting attachments with -EINVAL when the bound device does not match the target device.

This vulnerability can cause a denial of service via kernel panic or warning when a device-bound BPF program is attached to a different device and the original device is removed. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS vector, but no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to reject device-bound BPF programs attached to mismatched devices, preventing the issue. Users should apply the official kernel updates that include this fix. Since no patch links are provided here, consult the Linux kernel or distribution vendor advisories for the relevant fixed kernel versions. No additional mitigation is required once the fix is applied.