CVE-2026-74382

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_bpf: prevent unbounded recursion in offload rollback

Quan Sun reported [1] a stack overflow in cls_bpf_offload_cmd().

Reproducer on netdevsim: add a skip_sw cls_bpf filter, set the

bpf_tc_accept debugfs knob to 0, then `tc filter replace`. The replace

calls tc_setup_cb_replace() which fails. cls_bpf_offload_cmd() then

swaps prog/oldprog and recursively calls itself to roll back. But

bpf_tc_accept=0 makes the rollback fail too, which triggers yet another

rollback frame with the same arguments, and so on until the stack is

exhausted.

bpf_tc_accept is just a convenient knob for the reproducer. Any driver

whose tc_setup_cb_replace() fails twice in a row can hit the same loop,

so this is not a netdevsim-only issue.

Two ways to fix it:

1) Have the rollback call tc_setup_cb_add() on oldprog instead of

re-entering cls_bpf_offload_cmd().

2) Mark the rollback frame with a flag and skip a second-leve

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References