CVE-2026-74737: Linux Kernel TI CPSW Driver Out-of-Bounds Port ID Read

Overview

A vulnerability has been resolved in the Linux kernel's am65-cpsw-nuss driver, which handles the CPSW Ethernet controller on Texas Instruments AM65x and J721E system-on-chips — hardware commonly found in automotive and industrial embedded platforms. Tracked as CVE-2026-74737, the flaw affects the driver's packet-reception path and has carried an NVD-assigned CVSS score of 9.8 since publication on August 26, 2026.

Technical Details

How It Works

On the packet-reception path, the ID of the MAC port that received a packet is embedded in the RX DMA descriptor's metadata as a 16-bit hardware field. The driver extracted this port ID from the descriptor's SRC TAG field and used it directly as an array index without adequately validating the value first. A malformed or unexpected value in that hardware metadata field could drive the index out of bounds, leading to memory corruption or a kernel crash on the affected TI SoC hardware.

Context on the CVSS Score

Readers should weigh the 9.8 rating against what's actually required to trigger this bug: it is a driver-level flaw in a specific embedded network controller, not a remotely reachable service vulnerability. Exploitation requires the ability to deliver crafted packets to a device built on the affected TI SoC family and running an unpatched kernel — realistically an adjacent-network or on-path attacker, not an arbitrary internet-facing target. NVD's automated scoring for Linux kernel CVEs has repeatedly drawn criticism from kernel maintainers for defaulting to worst-case network/no-privilege assumptions on driver bugs that in practice require specific hardware and local network reachability. Treat the 9.8 as a ceiling, not a confirmed real-world exploitability rating — hence our "high" rather than "critical" classification here.

Impact

• Denial of service — the primary observed effect is sporadic kernel crashes on affected TI SoC hardware when receiving certain network packets
• Potential memory corruption — an out-of-bounds array index driven by attacker-influenced hardware metadata is a classic precursor to more serious memory-safety issues, though no working exploit for code execution has been published
• Scope — limited to devices running Linux kernel v5.7+ on TI AM65x/J721E platforms with the CPSW Ethernet controller active; this includes automotive, industrial control, and embedded networking gear built on this SoC family

Remediation

• Update to a kernel release containing the upstream fix for the am65-cpsw-nuss driver's port ID extraction logic
• Embedded/OEM vendors shipping TI AM65x or J721E based products should confirm their downstream kernel branch has backported the fix
• Where immediate patching isn't feasible, restrict network access to affected devices to trusted segments only

References

• NVD — CVE-2026-74737
• Linux kernel source — am65-cpsw-nuss driver