{"api_version":"1","generated_at":"2026-09-11T09:30:13+00:00","cve":"CVE-2026-74737","urls":{"html":"https://cve.report/CVE-2026-74737","api":"https://cve.report/api/cve/CVE-2026-74737.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74737","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74737"},"summary":{"title":"net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\n\nOn the packet reception path, the ID of the MAC Port on which the packet\nwas received, is embedded in the RX DMA Descriptor's metadata. The ID is\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\nin the 16-bit Source Tag into the 'port_id' variable. However, it is only\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\nWith the existing logic, sporadic kernel crash is observed due to the\nsubsequent driver code accessing out-of-bound memory because of an invalid\nport_id.\n\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\nSource Tag as the MAC Port ID.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-26 15:16:52","updated_at":"2026-08-27 06:17:22"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3","name":"https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892","name":"https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037","name":"https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd","name":"https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6","name":"https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce","name":"https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100","name":"https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f","name":"https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74737","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74737","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 14fc40bf28390e0ebee6a072457c36b82c614100 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 1c0e35ce761131f82062222779d8574849790892 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 9a220225efd6f58350bbb53fe70bdec08519267f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 551688b410d3fb0dae7739724422f268cd9446d6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 46a8e084a159e638ac2728e96980b65d752d65fd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 914e0100df3435bd14d09f397238e891cf9b7dce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93a76530316a3d8cc2d82c3deca48424fee92100 36a05d2820077bb3955acb8111e1041d39148037 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.266 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.217 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.184 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.153 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.105 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.46 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.10 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"74737","cve":"CVE-2026-74737","epss":"0.005590000","percentile":"0.441730000","score_date":"2026-08-27","updated_at":"2026-08-28 00:03:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/ti/am65-cpsw-nuss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"14fc40bf28390e0ebee6a072457c36b82c614100","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"},{"lessThan":"1c0e35ce761131f82062222779d8574849790892","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"},{"lessThan":"9a220225efd6f58350bbb53fe70bdec08519267f","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"},{"lessThan":"551688b410d3fb0dae7739724422f268cd9446d6","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"},{"lessThan":"46a8e084a159e638ac2728e96980b65d752d65fd","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"},{"lessThan":"72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"},{"lessThan":"914e0100df3435bd14d09f397238e891cf9b7dce","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"},{"lessThan":"36a05d2820077bb3955acb8111e1041d39148037","status":"affected","version":"93a76530316a3d8cc2d82c3deca48424fee92100","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/ti/am65-cpsw-nuss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.266","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.217","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.184","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.153","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.105","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.46","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.266","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.217","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.184","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.153","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.105","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.46","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.10","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\n\nOn the packet reception path, the ID of the MAC Port on which the packet\nwas received, is embedded in the RX DMA Descriptor's metadata. The ID is\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\nin the 16-bit Source Tag into the 'port_id' variable. However, it is only\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\nWith the existing logic, sporadic kernel crash is observed due to the\nsubsequent driver code accessing out-of-bound memory because of an invalid\nport_id.\n\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\nSource Tag as the MAC Port ID."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in am65_cpsw_nuss_rx_packets() on the NAPI RX path for TI AM65/J721E CPSW Ethernet; any remote host that can deliver L2 frames to a configured port triggers RX DMA completion and this handler without local access.\nAC:L - An attacker only needs to send Ethernet traffic to drive RX completions; although hardware upper source-tag bits make hits sporadic, sustained transmission reliably provokes the out-of-bounds port lookup without races or victim-specific state.\nPR:N - Exploitation requires no Linux credentials or capabilities—the vulnerable code runs in kernel RX softirq before socket demux or authentication, reachable by any entity that can send frames to the NIC.\nUI:N - Packet reception and NAPI polling are automatic once the interface is up; no victim mount, click, or other local action is needed beyond normal network connectivity to the device.\nS:U - Impact is kernel memory corruption and crash within the host kernel security domain; there is no VM, container, or IOMMU boundary crossover typical of Scope Changed scenarios.\nC:H - Invalid port_id indexes far past the kmalloc'd ports[] array (max eight) via am65_common_get_port(), causing out-of-bounds reads of adjacent kernel objects such as ndev pointers, xdp_prog, and other port fields.\nI:H - The same out-of-bounds port pointer drives writes including ndev stats increments, XDP processing, and skb association on attacker-supplied packet buffers, yielding a memory corruption primitive steerable toward kernel modification.\nA:H - The fix commit documents sporadic kernel oops/panics from out-of-bounds access when hardware source-tag upper bits inflate port_id beyond the small allocated ports array."}]}],"providerMetadata":{"dateUpdated":"2026-08-27T05:00:59.630Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100"},{"url":"https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892"},{"url":"https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f"},{"url":"https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6"},{"url":"https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd"},{"url":"https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3"},{"url":"https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce"},{"url":"https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037"}],"title":"net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74737","datePublished":"2026-08-26T14:36:50.544Z","dateReserved":"2026-08-15T05:44:03.930Z","dateUpdated":"2026-08-27T05:00:59.630Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-26 15:16:52","lastModifiedDate":"2026-08-27 06:17:22","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74737","Ordinal":"1","Title":"net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from S","CVE":"CVE-2026-74737","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74737","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG\n\nOn the packet reception path, the ID of the MAC Port on which the packet\nwas received, is embedded in the RX DMA Descriptor's metadata. The ID is\nextracted using the helper function cppi5_desc_get_tags_ids() which fills\nin the 16-bit Source Tag into the 'port_id' variable. However, it is only\nthe lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,\nwhile the upper 8-bits are Hardware-Reserved and carry an arbitrary value.\nWith the existing logic, sporadic kernel crash is observed due to the\nsubsequent driver code accessing out-of-bound memory because of an invalid\nport_id.\n\nHence, fix the port_id extraction logic to use only the lower 8-bits of the\nSource Tag as the MAC Port ID.","Type":"Description","Title":"net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from S"}]}}}