CVE-2026-74621 (GCVE-0-2026-74621)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:40
VLAI
Title
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine: if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(skb, &frag); else err = tcf_ct_ipv6_is_fragment(skb, &frag); if (err || !frag) return err; tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM; tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of them frees or queues the skb, so on that path the caller still owns it. tcf_ct_act() however funnels every non-zero return into the ownership-transfer exit: err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); if (err) goto out_frag; ... out_frag: if (err != -EINPROGRESS) tcf_action_inc_drop_qstats(&c->common); return TC_ACT_CONSUMED; TC_ACT_CONSUMED means the action took ownership of the skb, so no caller frees it - sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for that verdict. The skb is therefore orphaned: one sk_buff plus its data buffer is leaked per malformed packet, unbounded. Note the drop counter is already incremented for these errors, so the statistics claim a drop that never happens. Three different ownership states reach out_frag: today - the skb may be queued by the defrag engine (-EINPROGRESS), already freed by nf_ct_handle_fragments(), or still owned by us. Tell the caller which of those it is, and free the packet ourselves in the last case, which restores the TC_ACT_SHOT behaviour that predated the Fixes: commit. Reproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6 header with nexthdr = 0 (hop-by-hop) and nothing after it, on a clsact ingress chain with "action ct". kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet; with this patch it reports none.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6665 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 172ba7d46c202e679f3ccb10264c67416aaeb1c4 , < b5dbecc2016e1692fd1c2532af9c41ba729cb747 (git)
Affected: 0b5b831122fc3789fff75be433ba3e4dd7b779d4 , < 23e97d594ddd0153020c506d5041048fbde1beb4 (git)
Affected: 73f7da5fd124f2cda9161e2e46114915e6e82e97 , < 737873a59905a54ca0d2d127ef882f3f88bf4379 (git)
Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 47d99828591d0fe8be4b9c8992ff3b8e47968db9 (git)
Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < b47bb899e04b5407c5a63fe88d4b6676586a6e84 (git)
Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 439d3e404f9d5e515911cc8132cde198b337c19e (git)
Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 8a7ed561671aa6a911a2de99e59ef670a4d0b1df (git)
Affected: f5346df0591d10bc948761ca854b1fae6d2ef441 (git)
Affected: 5.15.148 , < 5.15.217 (semver)
Affected: 6.1.75 , < 6.1.184 (semver)
Affected: 6.6.14 , < 6.6.152 (semver)
Affected: 6.7.2 , < 6.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5dbecc2016e1692fd1c2532af9c41ba729cb747",
              "status": "affected",
              "version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4",
              "versionType": "git"
            },
            {
              "lessThan": "23e97d594ddd0153020c506d5041048fbde1beb4",
              "status": "affected",
              "version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4",
              "versionType": "git"
            },
            {
              "lessThan": "737873a59905a54ca0d2d127ef882f3f88bf4379",
              "status": "affected",
              "version": "73f7da5fd124f2cda9161e2e46114915e6e82e97",
              "versionType": "git"
            },
            {
              "lessThan": "47d99828591d0fe8be4b9c8992ff3b8e47968db9",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "b47bb899e04b5407c5a63fe88d4b6676586a6e84",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "439d3e404f9d5e515911cc8132cde198b337c19e",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "8a7ed561671aa6a911a2de99e59ef670a4d0b1df",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5346df0591d10bc948761ca854b1fae6d2ef441",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.152",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix sk_buff leak when the header checks reject a packet\n\ntcf_ct_handle_fragments() runs its header sanity checks before handing\nanything to the defragmentation engine:\n\n\tif (family == NFPROTO_IPV4)\n\t\terr = tcf_ct_ipv4_is_fragment(skb, \u0026frag);\n\telse\n\t\terr = tcf_ct_ipv6_is_fragment(skb, \u0026frag);\n\tif (err || !frag)\n\t\treturn err;\n\ntcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM;\ntcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of\nthem frees or queues the skb, so on that path the caller still owns it.\n\ntcf_ct_act() however funnels every non-zero return into the\nownership-transfer exit:\n\n\terr = tcf_ct_handle_fragments(net, skb, family, p-\u003ezone, \u0026defrag);\n\tif (err)\n\t\tgoto out_frag;\n\t...\nout_frag:\n\tif (err != -EINPROGRESS)\n\t\ttcf_action_inc_drop_qstats(\u0026c-\u003ecommon);\n\treturn TC_ACT_CONSUMED;\n\nTC_ACT_CONSUMED means the action took ownership of the skb, so no caller\nfrees it - sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for that verdict. The\nskb is therefore orphaned: one sk_buff plus its data buffer is leaked per\nmalformed packet, unbounded. Note the drop counter is already incremented\nfor these errors, so the statistics claim a drop that never happens.\n\nThree different ownership states reach out_frag: today - the skb may be\nqueued by the defrag engine (-EINPROGRESS), already freed by\nnf_ct_handle_fragments(), or still owned by us. Tell the caller which of\nthose it is, and free the packet ourselves in the last case, which\nrestores the TC_ACT_SHOT behaviour that predated the Fixes: commit.\n\nReproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6\nheader with nexthdr = 0 (hop-by-hop) and nothing after it, on a\nclsact ingress chain with \"action ct\". kmemleak reports one leaked\n232-byte skbuff_head_cache object plus its 704-byte data buffer per\npacket; with this patch it reports none."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak is triggered in tcf_ct_act() on the packet datapath (netif_receive_skb \u2192 sch_handle_ingress/egress \u2192 tc_run \u2192 tcf_classify); on OVN/Kubernetes/SDN gateways and mlx5-offload nodes with act_ct on clsact, a remote peer sends malformed IP packets with no local access required.\nAC:L - The attacker fully controls packet contents; a 54-byte IPv6 frame with nexthdr=0 (hop-by-hop) and no trailing data deterministically makes ipv6_find_hdr() return -EPROTO, leaking one skb per packet without races or uncontrollable layout dependencies.\nPR:N - Installing act_ct requires CAP_NET_ADMIN, but triggering the leak on an already-configured internet-facing or tenant-facing gateway needs no target credentials; a remote attacker only sends crafted malformed IP packets, matching CNA precedent for packet-driven act_ct issues (e.g., CVE-2026-72057).\nUI:N - Exploitation requires only attacker-generated malformed packets reaching a host with act_ct on clsact/ingress or egress; no victim login, mount, or other interactive action is needed beyond normal network traffic processing.\nS:U - The leaked sk_buff objects remain within the host kernel memory domain; this is not a VM escape, sandbox breakout, or IOMMU boundary bypass, only unbounded kernel heap consumption on the affected node.\nC:N - This is a pure sk_buff ownership leak on an error path; skb memory is orphaned, not exposed to the attacker, with no out-of-bounds read, use-after-free, or other disclosure primitive.\nI:N - The flaw only fails to kfree_skb() when header validation rejects a packet; it does not corrupt, overwrite, or modify any memory contents and provides no write or code-execution primitive.\nA:H - Each malformed packet leaks one sk_buff plus its data buffer (~936 bytes); sustained remote flooding causes unbounded kernel memory exhaustion and OOM denial of service, matching CNA precedent for repeatable network-triggered skb leaks (e.g., CVE-2026-52974)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:45.894Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5dbecc2016e1692fd1c2532af9c41ba729cb747"
        },
        {
          "url": "https://git.kernel.org/stable/c/23e97d594ddd0153020c506d5041048fbde1beb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/737873a59905a54ca0d2d127ef882f3f88bf4379"
        },
        {
          "url": "https://git.kernel.org/stable/c/47d99828591d0fe8be4b9c8992ff3b8e47968db9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b47bb899e04b5407c5a63fe88d4b6676586a6e84"
        },
        {
          "url": "https://git.kernel.org/stable/c/439d3e404f9d5e515911cc8132cde198b337c19e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a7ed561671aa6a911a2de99e59ef670a4d0b1df"
        }
      ],
      "title": "net/sched: act_ct: fix sk_buff leak when the header checks reject a packet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74621",
    "datePublished": "2026-08-22T15:32:04.990Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-08-25T05:40:45.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74621",
      "date": "2026-10-14",
      "epss": "0.0049",
      "percentile": "0.40604"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T01:49:00.000Z",
      "cve": "CVE-2026-74621",
      "id": "msrc_CVE-2026-74621",
      "initial_release_date": "2026-08-24T01:02:45.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: act_ct: fix sk_buff leak when the header checks reject a packet",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74621.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/act_ct.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b5dbecc2016e1692fd1c2532af9c41ba729cb747",
                    "status": "affected",
                    "version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "23e97d594ddd0153020c506d5041048fbde1beb4",
                    "status": "affected",
                    "version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "737873a59905a54ca0d2d127ef882f3f88bf4379",
                    "status": "affected",
                    "version": "73f7da5fd124f2cda9161e2e46114915e6e82e97",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47d99828591d0fe8be4b9c8992ff3b8e47968db9",
                    "status": "affected",
                    "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b47bb899e04b5407c5a63fe88d4b6676586a6e84",
                    "status": "affected",
                    "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "439d3e404f9d5e515911cc8132cde198b337c19e",
                    "status": "affected",
                    "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a7ed561671aa6a911a2de99e59ef670a4d0b1df",
                    "status": "affected",
                    "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f5346df0591d10bc948761ca854b1fae6d2ef441",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.217",
                    "status": "affected",
                    "version": "5.15.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.184",
                    "status": "affected",
                    "version": "6.1.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.152",
                    "status": "affected",
                    "version": "6.6.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "affected",
                    "version": "6.7.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/act_ct.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.8"
                  },
                  {
                    "lessThan": "6.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix sk_buff leak when the header checks reject a packet\n\ntcf_ct_handle_fragments() runs its header sanity checks before handing\nanything to the defragmentation engine:\n\n\tif (family == NFPROTO_IPV4)\n\t\terr = tcf_ct_ipv4_is_fragment(skb, \u0026frag);\n\telse\n\t\terr = tcf_ct_ipv6_is_fragment(skb, \u0026frag);\n\tif (err || !frag)\n\t\treturn err;\n\ntcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM;\ntcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of\nthem frees or queues the skb, so on that path the caller still owns it.\n\ntcf_ct_act() however funnels every non-zero return into the\nownership-transfer exit:\n\n\terr = tcf_ct_handle_fragments(net, skb, family, p-\u003ezone, \u0026defrag);\n\tif (err)\n\t\tgoto out_frag;\n\t...\nout_frag:\n\tif (err != -EINPROGRESS)\n\t\ttcf_action_inc_drop_qstats(\u0026c-\u003ecommon);\n\treturn TC_ACT_CONSUMED;\n\nTC_ACT_CONSUMED means the action took ownership of the skb, so no caller\nfrees it - sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for that verdict. The\nskb is therefore orphaned: one sk_buff plus its data buffer is leaked per\nmalformed packet, unbounded. Note the drop counter is already incremented\nfor these errors, so the statistics claim a drop that never happens.\n\nThree different ownership states reach out_frag: today - the skb may be\nqueued by the defrag engine (-EINPROGRESS), already freed by\nnf_ct_handle_fragments(), or still owned by us. Tell the caller which of\nthose it is, and free the packet ourselves in the last case, which\nrestores the TC_ACT_SHOT behaviour that predated the Fixes: commit.\n\nReproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6\nheader with nexthdr = 0 (hop-by-hop) and nothing after it, on a\nclsact ingress chain with \"action ct\". kmemleak reports one leaked\n232-byte skbuff_head_cache object plus its 704-byte data buffer per\npacket; with this patch it reports none."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/sched: act_ct: corrige la fuga de sk_buff cuando las comprobaciones de cabecera rechazan un paquete\n\ntcf_ct_handle_fragments() ejecuta sus comprobaciones de integridad de cabecera antes de entregar cualquier cosa al motor de desfragmentaci\u00f3n:\n\n\tif (family == NFPROTO_IPV4)\n\t\terr = tcf_ct_ipv4_is_fragment(skb, \u0026frag);\n\telse\n\t\terr = tcf_ct_ipv6_is_fragment(skb, \u0026frag);\n\tif (err || !frag)\n\t\treturn err;\n\ntcf_ct_ipv4_is_fragment() devuelve -EINVAL o -ENOMEM;\ntcf_ct_ipv6_is_fragment() a\u00f1ade -EPROTO cuando ipv6_find_hdr() falla. Ninguno de ellos libera o encola el skb, por lo que en esa ruta el llamador todav\u00eda lo posee.\n\ntcf_ct_act() sin embargo canaliza cada retorno no nulo hacia la salida de transferencia de propiedad:\n\n\terr = tcf_ct_handle_fragments(net, skb, family, p -\u003e zone, \u0026defrag);\n\tif (err)\n\t\tgoto out_frag;\n\t...\nout_frag:\n\tif (err != -EINPROGRESS)\n\t\ttcf_action_inc_drop_qstats(\u0026c -\u003e common);\n\treturn TC_ACT_CONSUMED;\n\nTC_ACT_CONSUMED significa que la acci\u00f3n tom\u00f3 posesi\u00f3n del skb, por lo que ning\u00fan llamador lo libera - sch_handle_ingress(), sch_handle_egress() y tcf_qevent_handle() omiten deliberadamente la liberaci\u00f3n para ese veredicto. El skb queda, por lo tanto, hu\u00e9rfano: un sk_buff m\u00e1s su b\u00fafer de datos se fuga por cada paquete malformado, sin l\u00edmites. N\u00f3tese que el contador de ca\u00eddas ya se incrementa para estos errores, por lo que las estad\u00edsticas afirman una ca\u00edda que nunca ocurre.\n\nTres estados de propiedad diferentes alcanzan out_frag: hoy - el skb puede ser encolado por el motor de desfragmentaci\u00f3n (-EINPROGRESS), ya liberado por nf_ct_handle_fragments(), o todav\u00eda en nuestra posesi\u00f3n. Informar al llamador cu\u00e1l de ellos es, y liberar el paquete nosotros mismos en el \u00faltimo caso, lo que restaura el comportamiento TC_ACT_SHOT que precedi\u00f3 al commit de Fixes:.\n\nReproducido en v7.2-rc6 con una trama de 54 bytes que transporta una cabecera IPv6 de 40 bytes con nexthdr = 0 (salto a salto) y nada despu\u00e9s de ella, en una cadena de entrada clsact con \u0027action ct\u0027. kmemleak informa de un objeto skbuff_head_cache de 232 bytes fugado m\u00e1s su b\u00fafer de datos de 704 bytes por paquete; con este parche no informa de ninguno."
          }
        ],
        "id": "CVE-2026-74621",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-22T16:16:34.897",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23e97d594ddd0153020c506d5041048fbde1beb4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/439d3e404f9d5e515911cc8132cde198b337c19e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47d99828591d0fe8be4b9c8992ff3b8e47968db9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/737873a59905a54ca0d2d127ef882f3f88bf4379"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8a7ed561671aa6a911a2de99e59ef670a4d0b1df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b47bb899e04b5407c5a63fe88d4b6676586a6e84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5dbecc2016e1692fd1c2532af9c41ba729cb747"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:51:15+00:00",
      "cve": "CVE-2026-74621",
      "id": "CVE-2026-74621",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74621.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.