CVE-2026-74620 (GCVE-0-2026-74620)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-23 12:47
VLAI
Title
net/sched: act_gact, act_police: range check the fallback control action
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0; TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it cannot be set that way. But act_gact and act_police each carry a second, independent control action supplied by user space that never reaches that helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned verbatim from the action. In particular user space can store TC_ACT_CONSUMED, which is TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value range. That verdict tells every caller the action took ownership of the skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for it. The result is one leaked sk_buff plus its data buffer per packet traversing the filter, unbounded, for all traffic on the chain including kernel-generated packets. Both are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so with pval = 1 gact_determ() returns the fallback for every packet. act_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and tcf_police_mtu_check() always passes. TC_ACT_CONSUMED was added by commit 720f22fed81b ("net: sched: refactor reinsert action"), after both goto-chain guards were written: commit 9469f375ab09 ("net/sched: act_gact: disallow 'goto chain' on fallback control action") and commit c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on fallback control action"). Neither guard was widened when the new verdict appeared. Factor the existing range test out of tcf_action_check_ctrlact() as tcf_action_valid() and apply it to both fallbacks. The helper cannot call tcf_action_check_ctrlact() directly because that also allocates a goto_chain, which is exactly what these two sites must not do. Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet. With this patch both configurations are rejected with -EINVAL and kmemleak reports none.
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6667 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 5f038affdacaffedf6a85a06cf59ec0a852d36a7 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 725efc2ab4a40affc4e285a2dc4896d103948a6c (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 6bcb8839aa2d686964a4154650afc4db91e1c514 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 5344e01179baa37547ab29fd7b8614f83faa190c (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 92f00f1d4d204a428b38e26fce3baee144b6955d (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 2e8df8c9190335475a3b64a159d3efd8cdd1cb73 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 883b56ae58fe657d8497806c7059646e9ba6dbd0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_gact.c",
            "net/sched/act_police.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f038affdacaffedf6a85a06cf59ec0a852d36a7",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "725efc2ab4a40affc4e285a2dc4896d103948a6c",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "6bcb8839aa2d686964a4154650afc4db91e1c514",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "5344e01179baa37547ab29fd7b8614f83faa190c",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "92f00f1d4d204a428b38e26fce3baee144b6955d",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "2e8df8c9190335475a3b64a159d3efd8cdd1cb73",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "883b56ae58fe657d8497806c7059646e9ba6dbd0",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_gact.c",
            "net/sched/act_police.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gact, act_police: range check the fallback control action\n\ntcf_action_check_ctrlact() range checks the primary control action:\n\n\tif (!opcode)\n\t\tret = action \u003e TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\n\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\n\nBoth are trivially deterministic. act_gact clamps tcfg_pval to \u003e= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\n\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow \u0027goto chain\u0027 on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow \u0027goto chain\u0027 on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\n\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\n\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:46.379Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4"
        },
        {
          "url": "https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514"
        },
        {
          "url": "https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c"
        },
        {
          "url": "https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73"
        },
        {
          "url": "https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0"
        }
      ],
      "title": "net/sched: act_gact, act_police: range check the fallback control action",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74620",
    "datePublished": "2026-08-22T15:32:04.254Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-08-23T12:47:46.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74620",
      "date": "2026-10-15",
      "epss": "0.00177",
      "percentile": "0.06742"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T01:58:57.000Z",
      "cve": "CVE-2026-74620",
      "id": "msrc_CVE-2026-74620",
      "initial_release_date": "2026-08-24T01:04:58.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: act_gact, act_police: range check the fallback control action",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74620.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/act_api.h",
                  "net/sched/act_gact.c",
                  "net/sched/act_police.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5f038affdacaffedf6a85a06cf59ec0a852d36a7",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "725efc2ab4a40affc4e285a2dc4896d103948a6c",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6bcb8839aa2d686964a4154650afc4db91e1c514",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5344e01179baa37547ab29fd7b8614f83faa190c",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92f00f1d4d204a428b38e26fce3baee144b6955d",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2e8df8c9190335475a3b64a159d3efd8cdd1cb73",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "883b56ae58fe657d8497806c7059646e9ba6dbd0",
                    "status": "affected",
                    "version": "720f22fed81bc6fd1765db7014651b6718887bea",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/act_api.h",
                  "net/sched/act_gact.c",
                  "net/sched/act_police.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.266",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gact, act_police: range check the fallback control action\n\ntcf_action_check_ctrlact() range checks the primary control action:\n\n\tif (!opcode)\n\t\tret = action \u003e TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\n\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\n\nBoth are trivially deterministic. act_gact clamps tcfg_pval to \u003e= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\n\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow \u0027goto chain\u0027 on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow \u0027goto chain\u0027 on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\n\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\n\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/sched: act_gact, act_police: comprobaci\u00f3n de rango de la acci\u00f3n de control de reserva\n\ntcf_action_check_ctrlact() comprueba el rango de la acci\u00f3n de control primaria:\n\n\tsi (!opcode)\n\t\tret = action \u003e TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX es TC_ACT_TRAP, por lo que los veredictos internos del kernel por encima de este no pueden establecerse de esa manera. Pero act_gact y act_police cada uno lleva una segunda acci\u00f3n de control independiente suministrada por el espacio de usuario que nunca llega a ese ayudante - TCA_GACT_PROB.paction y TCA_POLICE_RESULT. Ambos solo rechazan TC_ACT_GOTO_CHAIN, por lo que cualquier otro valor se almacena textualmente y se devuelve textualmente de la acci\u00f3n.\n\nEn particular, el espacio de usuario puede almacenar TC_ACT_CONSUMED, que es TC_ACT_VALUE_MAX + 1 y deliberadamente no forma parte del rango de valores de la UAPI. Ese veredicto le dice a cada llamador que la acci\u00f3n tom\u00f3 posesi\u00f3n del skb, por lo que nadie lo libera: sch_handle_ingress(), sch_handle_egress() y tcf_qevent_handle() todos omiten deliberadamente la liberaci\u00f3n para ello. El resultado es un sk_buff filtrado m\u00e1s su b\u00fafer de datos por cada paquete que atraviesa el filtro, sin l\u00edmites, para todo el tr\u00e1fico en la cadena, incluidos los paquetes generados por el kernel.\n\nAmbos son trivialmente deterministas. act_gact limita tcfg_pval a \u003e= 1, por lo que con pval = 1 gact_determ() devuelve la reserva para cada paquete. act_police no tiene una tasa obligatoria, por lo que rate = 0 deja tcfp_mtu = ~0 y tcf_police_mtu_check() siempre pasa.\n\nTC_ACT_CONSUMED fue a\u00f1adido por el commit 720f22fed81b (\u0027net: sched: refactor reinsert action\u0027), despu\u00e9s de que se escribieran ambos guardas de goto-chain:\ncommit 9469f375ab09 (\u0027net/sched: act_gact: disallow \u0027goto chain\u0027 on fallback control action\u0027) y\ncommit c08f5ed5d625 (\u0027net/sched: act_police: disallow \u0027goto chain\u0027 on fallback control action\u0027). Ninguno de los guardas fue ampliado cuando apareci\u00f3 el nuevo veredicto.\n\nFactorizar la prueba de rango existente de tcf_action_check_ctrlact() como tcf_action_valid() y aplicarla a ambas reservas. El ayudante no puede llamar a tcf_action_check_ctrlact() directamente porque eso tambi\u00e9n asigna un goto_chain, que es exactamente lo que estos dos sitios no deben hacer.\n\nReproducido en v7.2-rc6: kmemleak informa de un objeto skbuff_head_cache de 232 bytes filtrado m\u00e1s su b\u00fafer de datos de 704 bytes por paquete. Con este parche ambas configuraciones son rechazadas con -EINVAL y kmemleak no informa de ninguno."
          }
        ],
        "id": "CVE-2026-74620",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {},
        "published": "2026-08-22T16:16:34.753",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-24T14:48:29+00:00",
      "cve": "CVE-2026-74620",
      "id": "CVE-2026-74620",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: act_gact, act_police: range check the fallback control action",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74620.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.