Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res->classid in tc_cls_bind_class(). The issue can be reproduced with the following commands: tc qdisc add dev lo root handle 1: hfsc tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1 tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit Fix this by skipping hash tables via the TC_U32_KEY(handle) check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:16:52.603Z",
  "pubdate": "2026-08-26T15:16:52.603Z",
  "executiveSummary": "A slab-out-of-bounds read vulnerability exists in the Linux kernel's net/sched: cls_u32 component.\nThe vulnerability arises due to an improper type cast during the class binding process within the tc filter u32 classifier.\nAn attacker capable of executing tc (traffic control) commands can trigger this vulnerability, resulting in an out-of-bounds memory access.\nThe impact includes potential information disclosure or kernel instability, specifically triggering a kernel panic or crash.\nThe flaw affects the u32_bind_class function, which fails to distinguish between different structure types during enumeration by the walker callback.\nThis vulnerability requires local access to the system or appropriate capabilities to manipulate network traffic control structures.",
  "technicalDetails": "The root cause of this vulnerability lies in the u32_bind_class() function within the net/sched/cls_u32.c kernel module. The u32_walk() function is responsible for enumerating structures of type struct tc_u_hnode (hash tables) and struct tc_u_knode (keys).\nIn the vulnerable implementation, u32_bind_class() receives a handle (fh) and unconditionally casts it to a struct tc_u_knode pointer. This cast assumes that the memory region pointed to by fh contains the tcf_result member found within the tc_u_knode structure.\nHowever, if the enumerated object is actually a struct tc_u_hnode, the memory layout differs significantly. Because tc_u_hnode does not contain a tcf_result member at the expected offset, the subsequent access to res->classid within tc_cls_bind_class() results in an out-of-bounds read from the slab allocator.\nThe attack flow involves: 1) Constructing a traffic control (tc) configuration using the u32 classifier; 2) Triggering the u32_walk process which iterates over both nodes and hash tables; 3) The walker passes an object of type tc_u_hnode to the bind callback; 4) The callback performs the unsafe cast, accessing memory that does not belong to the intended structure.\nThis behavior leads to a slab-out-of-bounds read, as the kernel treats arbitrary or adjacent heap memory as part of a tc_u_knode structure. Depending on the memory layout and the values stored at the overflowed address, this can lead to memory corruption, kernel panics, or the leakage of sensitive kernel memory contents to userspace via the traffic control interface.\nThe issue is exacerbated by the fact that the u32 classifier logic lacks a validation check to differentiate between node types before performing pointer arithmetic on the provided handle. By utilizing the TC_U32_KEY() macro to inspect the handle, the kernel can identify whether the structure is a key node or a hash table node, allowing it to skip invalid nodes that lack the necessary tcf_result member."
}