CVE-2026-74290

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_flow: Dont expose folded kernel pointers

The flow classifier falls back to addr_fold() for fields that are missing

from packet headers. In map mode, userspace controls mask, xor, rshift,

addend and divisor, and can observe the resulting classid through class

statistics. This allows a tc classifier in a user/network namespace to

recover the 32-bit folded value of skb->sk, skb_dst() or skb_nfct().

Align with standard kernel practices for pointer hashing and replace the

XOR folding with a keyed siphash (which is cryptographically secure)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References