---
id: CVE-2026-74290
title: 'net/sched: cls_flow: Dont expose folded kernel pointers'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: cls_flow: Dont expose folded kernel pointers

  The flow classifier falls back to addr_fold() for fields that are missing
  from packet headers. In map mode, use…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe <
    19f2ecf8ea564562c7e7a919cf38068dd9aa1c96
  - >-
    Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe <
    3d054001860270748405a3f9270c5fa0bf7ffc19
  - >-
    Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe <
    fb31fbe51c233f3bf47021121f63d2e42cac2d08
  - >-
    Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe <
    0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a
  - >-
    Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe <
    6151159618198675e01c391676e579738286c135
  - >-
    Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe <
    f294fc71c4a0fa4964f6428a1b4e7929c1d83125
  - Linux 2.6.25
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:55:56.474806Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:43.605Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74290'
references:
  - url: 'https://git.kernel.org/stable/c/19f2ecf8ea564562c7e7a919cf38068dd9aa1c96'
  - url: 'https://git.kernel.org/stable/c/3d054001860270748405a3f9270c5fa0bf7ffc19'
  - url: 'https://git.kernel.org/stable/c/fb31fbe51c233f3bf47021121f63d2e42cac2d08'
  - url: 'https://git.kernel.org/stable/c/0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a'
  - url: 'https://git.kernel.org/stable/c/6151159618198675e01c391676e579738286c135'
  - url: 'https://git.kernel.org/stable/c/f294fc71c4a0fa4964f6428a1b4e7929c1d83125'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06715
ingestedAt: '2026-11-06T18:00:12.564Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_flow: Dont expose folded kernel pointers

The flow classifier falls back to addr_fold() for fields that are missing
from packet headers. In map mode, userspace controls mask, xor, rshift,
addend and divisor, and can observe the resulting classid through class
statistics. This allows a tc classifier in a user/network namespace to
recover the 32-bit folded value of skb->sk, skb_dst() or skb_nfct().

Align with standard kernel practices for pointer hashing and replace the
XOR folding with a keyed siphash (which is cryptographically secure)

## Affected

- `Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe < 19f2ecf8ea564562c7e7a919cf38068dd9aa1c96`
- `Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe < 3d054001860270748405a3f9270c5fa0bf7ffc19`
- `Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe < fb31fbe51c233f3bf47021121f63d2e42cac2d08`
- `Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe < 0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a`
- `Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe < 6151159618198675e01c391676e579738286c135`
- `Linux >= e5dfb815181fcb186d6080ac3a091eadff2d98fe < f294fc71c4a0fa4964f6428a1b4e7929c1d83125`
- `Linux 2.6.25`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.