Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates `ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior per C11 6.5.7p3, triggerable by an unprivileged user via user/network namespaces. UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43 shift exponent 32 is too large for 32-bit type int Fix this by rejecting offshift >= 16 during filter creation in u32_change().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:59.753Z",
  "pubdate": "2026-08-15T13:17:59.753Z",
  "executiveSummary": "A shift-out-of-bounds vulnerability exists in the Linux kernel network scheduler subsystem, specifically within the u32 classifier (cls_u32). The flaw arises due to a lack of input validation on the user-provided offshift value during filter creation via u32_change().\nAn unprivileged local user or an attacker operating within user or network namespaces can supply an out-of-bounds offshift value (>= 16, up to 255). When a network packet subsequently triggers the u32_classify() function with the TC_U32_VAROFFSET flag enabled, the kernel evaluates a bitwise right-shift operation using a shift exponent that exceeds the width of the data type, resulting in undefined behavior as defined by the C11 standard.\nThe primary impact of this vulnerability includes undefined behavior, potential kernel sanitizer (UBSAN) warnings, and potential denial-of-service conditions or unpredictable control flow depending on compiler optimizations and CPU architecture handling of oversized shift operations.\nSuccessful exploitation requires the capability to create and configure network traffic control (tc) filters via user or network namespaces, enabling unprivileged threat actors to trigger the flaw.",
  "technicalDetails": "The vulnerability resides in the net/sched/cls_u32.c file within the Linux kernel network scheduling infrastructure, specifically affecting the u32_change() and u32_classify() functions.\nThe root cause is insufficient input validation in u32_change(), which accepts a user-provided tc_u32_sel.offshift value—an unsigned char ranging from 0 to 255—and copies it directly into the kernel knode object without verifying its range.\nDuring packet processing, when a packet hits u32_classify() with the TC_U32_VAROFFSET flag set, the kernel executes the expression `ntohs(offmask & *data) >> offshift`. In this operation, the left operand is a 16-bit network-ordered value promoted to a 32-bit integer, and offshift acts as the shift exponent.\nPer C11 standard section 6.5.7p3, performing a shift operation with an exponent greater than or equal to the width of the promoted type (32 bits, or in this specific logical context where the underlying data is 16-bit, values >= 16) results in undefined behavior. The UBSAN runtime specifically flags this as a shift-out-of-bounds error when the shift exponent is 32 or otherwise too large for the evaluated type.\nAn attacker triggers this vulnerability by performing the following step-by-step attack flow: First, the attacker establishes access within a user or network namespace where they possess privileges to configure traffic control (tc) rules. Second, the attacker invokes u32_change() to create or modify a u32 filter, supplying a malicious tc_u32_sel.offshift value >= 16. Third, the attacker transmits network packets designed to traverse the affected classifier instance, forcing the execution path into u32_classify() with TC_U32_VAROFFSET enabled. Finally, the oversized shift exponent is evaluated during packet classification, triggering undefined behavior in the kernel execution context."
}