Skip to main content

Linux Kernel CVE-2026-74737

| EUVDEUVD-2026-66567 CRITICAL
2026-08-26 Linux GHSA-582m-3r7c-4438
Denial Of Service Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Device runs am65-cpsw-nuss on TI AM65 hardware
  2. Delivery
    Packet received on CPSW MAC port
  3. Exploit
    Reserved upper Source-Tag bits yield invalid port_id
  4. Execution
    Driver indexes out of bounds
  5. Impact
    Kernel panic and device DoS

Vulnerability Assessment

Exploitation Conditions

Requires the target to be running the Linux am65-cpsw-nuss driver on TI AM65x/K3-class Ethernet hardware and to be actively receiving packets on those CPSW MAC ports - the flaw is in how that driver parses the CPPI5 RX DMA descriptor Source Tag, so systems without this TI networking hardware/driver are not affected at all. The crash arises from arbitrary hardware-reserved bits in the descriptor metadata, not from an attacker-chosen field, so it is sporadic and not shown to be deterministically attacker-controlled. Limiting factors: platform-specific to TI Sitara AM65/K3 SoCs, availability impact only per the DoS tag, and requires the affected driver to be in use with ports up.
Impact

The signals conflict sharply. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) is the generic worst-case score auto-assigned to many Linux kernel CVEs and overstates this issue: the vendor tag explicitly says Denial Of Service and the description describes only a sporadic crash from out-of-bounds access, with no plausible confidentiality or integrity impact. No EPSS score, KEV listing, or POC is present in the data - no public exploit identified at time of analysis. Exploitation is not reliably attacker-controlled: the crash stems from arbitrary hardware-reserved bits, and it only manifests on systems built on TI AM65/K3 SoCs using this specific driver. Net assessment: low real-world priority despite the 9.8 - a stability/reliability fix for embedded TI-based devices rather than a remotely weaponizable RCE. Verify with vendor: CVSS claims network vector and full CIA impact, but the description and DoS tag imply an availability-only, hardware-triggered crash on specific platforms.
Exploit ScenarioDerived

On a TI AM65x/K3-based device (e.g. an industrial gateway or system-on-module) running an unpatched kernel, the CPSW receives frames and the RX descriptor's reserved upper Source-Tag bits occasionally present a non-zero value; the driver derives an out-of-range port_id, indexes past valid memory, and the kernel panics, dropping the device offline. No public POC is present in the data, and the trigger depends on hardware-supplied bits rather than a crafted network payload, so reliable adversarial triggering is not demonstrated.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 27, 2026

Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. No public exploit is identified and it is not on CISA KEV; the vendor-tagged impact is Denial Of Service, not the remote code execution implied by the automated 9.8 score.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your series - 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, or 7.1.10 or later (mainline fix in the 7.1/7.2 window). The fix masks the Source Tag to its lower 8 bits in am65-cpsw-nuss.c; apply the corresponding stable commit from git.kernel.org/stable/c/ (e.g. https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100). Because the defect is confined to the am65-cpsw-nuss driver, the practical compensating control on devices that cannot immediately update is to avoid using the affected TI CPSW interfaces - do not bring up the am65-cpsw-nuss-driven ports, or blacklist the module where the SoC's networking can be provided another way; the trade-off is loss of that Ethernet connectivity, so this is only viable where those ports are unused. No configuration-only workaround eliminates the crash while the affected ports carry traffic.

Affected VersionsENISA

Linux patch: 7.2
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <1c0e35ce761131f82062222779d8574849790892
Linux patch: 5.15.217
Linux 5.7
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <914e0100df3435bd14d09f397238e891cf9b7dce
Linux patch: 0
Linux patch: 6.12.105
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <36a05d2820077bb3955acb8111e1041d39148037
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <551688b410d3fb0dae7739724422f268cd9446d6
Linux patch: 6.6.153
Linux patch: 6.1.184
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <46a8e084a159e638ac2728e96980b65d752d65fd
Linux patch: 7.1.10
Linux patch: 6.18.46
Linux patch: 5.10.266
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <9a220225efd6f58350bbb53fe70bdec08519267f
Linux 93a76530316a3d8cc2d82c3deca48424fee92100 <14fc40bf28390e0ebee6a072457c36b82c614100

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug is in drivers/net/ethernet/ti/am65-cpsw-nuss.c, the driver for TI's Common Platform Ethernet Switch (CPSW) and Networking Subsystem (NUSS) on K3/AM65x SoCs. On packet reception the ingress MAC port ID is carried in CPPI5 RX DMA descriptor metadata (Source Tag). The helper cppi5_desc_get_tags_ids() returns the entire 16-bit Source Tag into port_id, but hardware only encodes the port ID in the low 8 bits while the high 8 bits are reserved and hold arbitrary values. Using the unmasked value as a port index is an out-of-bounds access (out-of-bounds read / improper array index, CWE-125/CWE-129 class); the source CWE field is N/A. The fix masks the value to the lower 8 bits before use.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.3 MEDIUM

Availability-only crash on specific TI hardware; adjacent packet reception with high complexity due to reliance on sporadic reserved-bit values, and no confidentiality or integrity impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 27, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 26, 2026 - 16:17 EUVD
CVE Published
Aug 26, 2026 - 14:36 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 26, 2026 - 14:36 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id.

Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.

Articles & Coverage 1

News Critical Denial of Service in Linux Kernel TI AM65 CPSW Driver - CVE-2026-74737 Aug 27, 2026

Executive ViewAI

Why It Matters

The TI AM65 CPSW NUSS Ethernet driver in the Linux kernel contains a critical flaw triggering kernel panics on systems using TI Sitara/K3 (AM65x-class) hardware, disrupting system availability. While the CVSS 9.8 rating reflects network accessibility, the actual impact is denial of service rather than remote code execution. Organizations running this specific hardware should prioritize patching to restore system stability.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 56% exploitable
Prevalence
Low
driver specific to TI AM65x/K3 embedded SoCs, niche hardware footprint
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74737 ADVISORY https://ubuntu.com/security/notices/USN-8886-1 ADVISORY https://vuldb.com/vuln/395794 REF https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100 REF https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892 REF https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037 REF https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd REF https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6 REF https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3 REF https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce REF https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy