CVE-2026-74737 - Vulnerability Details

- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

On the packet reception path, the ID of the MAC Port on which the packet
was received, is embedded in the RX DMA Descriptor's metadata. The ID is
extracted using the helper function cppi5_desc_get_tags_ids() which fills
in the 16-bit Source Tag into the 'port_id' variable. However, it is only
the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID,
while the upper 8-bits are Hardware-Reserved and carry an arbitrary value.
With the existing logic, sporadic kernel crash is observed due to the
subsequent driver code accessing out-of-bound memory because of an invalid
port_id.

Hence, fix the port_id extraction logic to use only the lower 8-bits of the
Source Tag as the MAC Port ID.

Published: 2026-08-26

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A defect in the Linux AM65 CPSW driver causes the MAC port identifier to be extracted from a 16‑bit source tag that contains an arbitrary, hardware‑reserved upper byte. The upper byte is incorrectly interpreted as part of the port ID, leading to an invalid index that can trigger an out‑of‑bounds memory access in the driver. This crash can compromise availability or permit more severe exploitation when combined with other kernel vulnerabilities.

Affected Systems

Linux kernel users employing the TI Am65 CPSW (cpsw‑nuss) network driver are affected. The bug is present in kernel releases that include the outdated port_id extraction logic; the fix is applied in the commit series referenced in the provided patch URLs.

Risk and Exploitability

The flaw can be triggered by receiving a packet whose source tag has a non‑zero, arbitrary upper 8 bits; this is a network‑based attack vector inferred from the packet reception path. The flaw yields a CVSS score of 9.8, indicating critical severity. While an EPSS score of 0.00559 (< 1%) is reported and the vulnerability is not listed in KEV, the potential to cause a kernel panic makes it a high‑impact condition.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 14fc40bf28390e0ebee6a072457c36b82c614100
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 1c0e35ce761131f82062222779d8574849790892
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 9a220225efd6f58350bbb53fe70bdec08519267f
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 551688b410d3fb0dae7739724422f268cd9446d6
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 46a8e084a159e638ac2728e96980b65d752d65fd
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 914e0100df3435bd14d09f397238e891cf9b7dce
`93a76530316a3d8cc2d82c3deca48424fee92100`	affected	< 36a05d2820077bb3955acb8111e1041d39148037

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[93a76530316a3d8cc2d82c3deca48424fee92100,14fc40bf28390e0ebee6a072457c36b82c614100)`	affected	code_commit	—
`[93a76530316a3d8cc2d82c3deca48424fee92100,1c0e35ce761131f82062222779d8574849790892)`	affected	code_commit	—
`[93a76530316a3d8cc2d82c3deca48424fee92100,9a220225efd6f58350bbb53fe70bdec08519267f)`	affected	code_commit	—
`[93a76530316a3d8cc2d82c3deca48424fee92100,551688b410d3fb0dae7739724422f268cd9446d6)`	affected	code_commit	—
`[93a76530316a3d8cc2d82c3deca48424fee92100,46a8e084a159e638ac2728e96980b65d752d65fd)`	affected	code_commit	—
`[93a76530316a3d8cc2d82c3deca48424fee92100,72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3)`	affected	code_commit	—
`[93a76530316a3d8cc2d82c3deca48424fee92100,914e0100df3435bd14d09f397238e891cf9b7dce)`	affected	code_commit	—
`[93a76530316a3d8cc2d82c3deca48424fee92100,36a05d2820077bb3955acb8111e1041d39148037)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	semver	—
`[0,5.7)`	unaffected	semver	—
`[5.10.266,5.10.*]`	unaffected	generic	—
`[5.15.217,5.15.*]`	unaffected	generic	—
`[6.1.184,6.1.*]`	unaffected	generic	—
`[6.6.153,6.6.*]`	unaffected	generic	—
`[6.12.105,6.12.*]`	unaffected	generic	—
`[6.18.46,6.18.*]`	unaffected	generic	—
`[7.1.10,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel release or apply the specific patch series that fixes the port_id extraction logic (commit 14fc40bf... and related references).
If an immediate kernel update cannot be performed, disable or isolate the affected device’s network interface or prevent it from receiving traffic from untrusted sources until the fix is in place.
Configure host monitoring and alerting to detect kernel panics or out‑of‑bounds access failures in the network stack, enabling rapid response if exploitation occurs.

Generated by OpenCVE AI on August 28, 2026 at 16:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00559.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100
https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892
https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037
https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd
https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6
https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3
https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce
https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74737-bf95@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74737
https://www.cve.org/CVERecord?id=CVE-2026-74737

History

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74737-bf95@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74737 https://www.cve.org/CVERecord?id=CVE-2026-74737
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 27 Aug 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-20

Thu, 27 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-125 CWE-129

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 26 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-129

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id. Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.
Title		net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14fc40bf28390e0ebee6a072457c36b82c614100 https://git.kernel.org/stable/c/1c0e35ce761131f82062222779d8574849790892 https://git.kernel.org/stable/c/36a05d2820077bb3955acb8111e1041d39148037 https://git.kernel.org/stable/c/46a8e084a159e638ac2728e96980b65d752d65fd https://git.kernel.org/stable/c/551688b410d3fb0dae7739724422f268cd9446d6 https://git.kernel.org/stable/c/72e4e3d7efc3b7d85f86abbe8b94f8e45074abe3 https://git.kernel.org/stable/c/914e0100df3435bd14d09f397238e891cf9b7dce https://git.kernel.org/stable/c/9a220225efd6f58350bbb53fe70bdec08519267f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:36:50.544Z

Updated: 2026-08-27T05:00:59.630Z

Reserved: 2026-08-15T05:44:03.930Z

Link: CVE-2026-74737

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:16:52.313

Modified: 2026-08-27T06:17:22.950

Link: CVE-2026-74737

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-74737 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T16:45:03Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read
CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object