{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74737","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.930Z","datePublished":"2026-08-26T14:36:50.544Z","dateUpdated":"2026-08-27T05:00:59.630Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-27T05:00:59.630Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\n\nOn the packet reception path, the ID of the MAC Port on which the packet\nwas received, is embedded in the RX DMA Descriptor's metadata. The ID is\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\nin the 16-bit Source Tag into the 'port_id' variable. However, it is only\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\nWith the existing logic, sporadic kernel crash is observed due to the\nsubsequent driver code accessing out-of-bound memory because of an invalid\nport_id.\n\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\nSource Tag as the MAC Port ID."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in am65_cpsw_nuss_rx_packets() on the NAPI RX path for TI AM65/J721E CPSW Ethernet; any remote host that can deliver L2 frames to a configured port triggers RX DMA completion and this handler without local access.\nAC:L - An attacker only needs to send Ethernet traffic to drive RX completions; although hardware upper source-tag bits make hits sporadic, sustained transmission reliably provokes the out-of-bounds port lookup without races or victim-specific state.\nPR:N - Exploitation requires no Linux credentials or capabilities—the vulnerable code runs in kernel RX softirq before socket demux or authentication, reachable by any entity that can send frames to the NIC.\nUI:N - Packet reception and NAPI polling are automatic once the interface is up; no victim mount, click, or other local action is needed beyond normal network connectivity to the device.\nS:U - Impact is kernel memory corruption and crash within the host kernel security domain; there is no VM, container, or IOMMU boundary crossover typical of Scope Changed scenarios.\nC:H - Invalid port_id indexes far past the kmalloc'd ports[] array (max eight) via am65_common_get_port(), causing out-of-bounds reads of adjacent kernel objects such as ndev pointers, xdp_prog, and other port fields.\nI:H - The same out-of-bounds port pointer drives writes including ndev stats increments, XDP processing, and skb association on attacker-supplied packet buffers, yielding a memory corruption primitive steerable toward kernel modification.\nA:H - The fix commit documents sporadic kernel oops/panics from out-of-bounds access when hardware source-tag upper bits inflate port_id beyond the small allocated ports array."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/ti/am65-cpsw-nuss.c"],"versions":[{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"14fc40bf28390e0ebee6a072457c36b82c614100","status":"affected","versionType":"git"},{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"1c0e35ce761131f82062222779d8574849790892","status":"affected","versionType":"git"},{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"9a220225efd6f58350bbb53fe70bdec08519267f","status":"affected","versionType":"git"},{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"551688b410d3fb0dae7739724422f268cd9446d6","status":"affected","versionType":"git"},{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"46a8e084a159e638ac2728e96980b65d752d65fd","status":"affected","versionType":"git"},{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3","status":"affected","versionType":"git"},{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"914e0100df3435bd14d09f397238e891cf9b7dce","status":"affected","versionType":"git"},{"version":"93a76530316a3d8cc2d82c3deca48424fee92100","lessThan":"36a05d2820077bb3955acb8111e1041d39148037","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/ti/am65-cpsw-nuss.c"],"versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","status":"unaffected","versionType":"semver"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.10","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.10.266"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.15.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.6.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.12.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.18.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.1.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100"},{"url":"https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892"},{"url":"https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f"},{"url":"https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6"},{"url":"https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd"},{"url":"https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3"},{"url":"https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce"},{"url":"https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037"}],"title":"net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG","x_generator":{"engine":"bippy-1.2.0"}}}}