Linux Kernel CVE-2026-74739

Exploitation requires: (1) local system access, and (2) CAP_NET_ADMIN capability - obtainable without root on systems with unprivileged user namespaces enabled (default on Ubuntu 22.04+, Debian 11+, Fedora, and most Kubernetes node OSes). The trigger is specific: an HFSC qdisc must be created on a network interface, at least two HFSC classes added, a U32 filter with a u32 match rule attached to a class, and a second class subsequently added - exactly the four-command sequence in the description. Standard unprivileged users on systems where kernel.unprivileged_userns_clone=0 or equivalent restrictions are enforced cannot trigger the vulnerability. Exploitation is further limited to network-namespace-capable environments; hardened systems using seccomp profiles that block NETLINK_ROUTE are not reachable. There is no remote attack vector - physical or shell access is an absolute prerequisite.

The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a high-severity local privilege escalation with low attack complexity. The PR:L designation is appropriate because, while tc manipulation nominally requires CAP_NET_ADMIN, Linux systems with user namespaces enabled (the default on Ubuntu, Debian, and most container runtimes) allow unprivileged users to acquire CAP_NET_ADMIN within a network namespace - enabling direct reproduction via the documented tc commands. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. The absence of a KEV listing and no identified public POC suggest this is not currently under mass exploitation, but the deterministic reproduction steps embedded in the CVE description lower the bar for weaponization. The full C:H/I:H/A:H impact is plausible given that controlled slab heap corruption is a well-established kernel privilege escalation primitive. Risk is elevated for multi-tenant Linux hosts, Kubernetes nodes, and container environments where user namespace access is broadly granted.

A local attacker with access to user namespaces (available by default on most modern Linux distributions) creates a network namespace to obtain CAP_NET_ADMIN, then issues the exact sequence of tc commands documented in the CVE description: adding an HFSC qdisc, multiple HFSC classes, and a U32 filter. When the second class bind triggers u32_bind_class() to walk the U32 classifier tree, a tc_u_hnode is passed and miscast, causing a slab-out-of-bounds read that can be leveraged for heap layout manipulation and subsequent root privilege escalation. No public POC has been identified, but the deterministic reproduction steps in the description effectively constitute a technical blueprint.