What is the CVSS score of CVE-2026-74544?

CVE-2026-74544 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74544?

A Linux kernel vulnerability in the traffic control classifier enables local privilege escalation on systems configured for unprivileged namespace creation-a standard feature in containerized and…. A patch is available.

How to fix or mitigate CVE-2026-74544?

Within 24 hours, inventory Linux systems running kernel versions prior to 7.1.8, with priority focus on infrastructure where unprivileged namespace creation is enabled (containers, Kubernetes nodes, development systems). Within 7 days, deploy the patched stable kernel release 7.1.8 (or 7.2-rc6 for 7.2-path systems) to development and test infrastructure to validate compatibility and performance. Within 30 days, complete kernel patching across all production Linux deployments to eliminate the local privilege escalation vector.

Linux Kernel CVE-2026-74544

EUVD-2026-59737 HIGH

2026-08-15 Linux

GHSA-p37c-4w2w-mm9f

Buffer Overflow Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only vector requiring namespace access (PR:L); no interaction needed; UB in kernel context yields full C/I/A impact against the vulnerable system.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:18 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates ntohs(offmask & *data) >> offshift where the left operand is a 16-bit value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior per C11 6.5.7p3, triggerable by an unprivileged user via user/network namespaces.

UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43 shift exponent 32 is too large for 32-bit type int

Fix this by rejecting offshift >= 16 during filter creation in u32_change().

AnalysisAI

Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain low-privilege local shell

Delivery

Create user/network namespace via unshare

Exploit

Install tc u32 filter with offshift ≥ 32 and TC_U32_VAROFFSET

Execution

Trigger packet classification on crafted traffic

Persist

Undefined shift-out-of-bounds UB executes in kernel context

Impact

Escalate to kernel privileges

Access

Gain low-privilege local shell

Delivery

Create user/network namespace via unshare

Exploit

Install tc u32 filter with offshift ≥ 32 and TC_U32_VAROFFSET

Execution

Trigger packet classification on crafted traffic

Persist

Undefined shift-out-of-bounds UB executes in kernel context

Impact

Escalate to kernel privileges

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) local access to the target Linux system with at minimum a low-privilege user account (CVSS PR:L confirmed); (2) the ability to create or enter a user or network namespace - this is controlled by kernel.unprivileged_userns_clone and related sysctls, which are enabled by default on Debian, Ubuntu, and many container-oriented distributions but disabled on RHEL/CentOS default configurations; (3) CAP_NET_ADMIN capability within that namespace, which is typically granted automatically when the user creates their own network namespace; (4) the crafted tc u32 filter must explicitly set the TC_U32_VAROFFSET flag with offshift >= 32 in the tc_u32_sel structure. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N is well-calibrated: exploitation requires only local low-privilege access, leveraging user or network namespaces that are enabled by default on many Linux distributions, making the effective attack bar lower than 'local' might imply on hardened systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker with a standard user account on a Linux system where unprivileged user namespaces are enabled creates a new network namespace via unshare(1), then uses tc(8) to install a u32 classifier filter with TC_U32_VAROFFSET set and an offshift value of 32 or greater. When subsequent network traffic is processed by the classifier, the kernel executes the undefined shift operation; depending on compiler optimizations and platform ABI, this may produce an out-of-bounds read into adjacent kernel memory or corrupt control flow, providing a primitive for local-to-root privilege escalation. …
Remediation	Upgrade to Linux kernel 7.1.8 (stable) or apply 7.2-rc6 for users tracking the release candidate series; both incorporate the validated fix at commits 313cb9ffc410 and aef96eead286 (https://git.kernel.org/stable/c/313cb9ffc4101a885d791facf4b5ea3d5e06144d, https://git.kernel.org/stable/c/aef96eead2860cbfa371e4471d4f04412213b958). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory Linux systems running kernel versions prior to 7.1.8, with priority focus on infrastructure where unprivileged namespace creation is enabled (containers, Kubernetes nodes, development systems). …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74544 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74544

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code