CVE-2026-74620

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74620", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.921Z", "datePublished": "2026-08-22T15:32:04.254Z", "dateUpdated": "2026-11-06T17:05:49.005Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:46.379Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gact, act_police: range check the fallback control action\n\ntcf_action_check_ctrlact() range checks the primary control action:\n\n\tif (!opcode)\n\t\tret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\n\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\n\nBoth are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\n\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow 'goto chain' on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow 'goto chain' on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\n\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\n\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/act_api.h", "net/sched/act_gact.c", "net/sched/act_police.c"], "versions": [{"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "5f038affdacaffedf6a85a06cf59ec0a852d36a7", "status": "affected", "versionType": "git"}, {"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4", "status": "affected", "versionType": "git"}, {"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "725efc2ab4a40affc4e285a2dc4896d103948a6c", "status": "affected", "versionType": "git"}, {"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "6bcb8839aa2d686964a4154650afc4db91e1c514", "status": "affected", "versionType": "git"}, {"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "5344e01179baa37547ab29fd7b8614f83faa190c", "status": "affected", "versionType": "git"}, {"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "92f00f1d4d204a428b38e26fce3baee144b6955d", "status": "affected", "versionType": "git"}, {"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "2e8df8c9190335475a3b64a159d3efd8cdd1cb73", "status": "affected", "versionType": "git"}, {"version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "883b56ae58fe657d8497806c7059646e9ba6dbd0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/act_api.h", "net/sched/act_gact.c", "net/sched/act_police.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7"}, {"url": "https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4"}, {"url": "https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c"}, {"url": "https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514"}, {"url": "https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c"}, {"url": "https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d"}, {"url": "https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73"}, {"url": "https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0"}], "title": "net/sched: act_gact, act_police: range check the fallback control action", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74620", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:00.692905Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:05:49.005Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74620", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:00.692905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:00:04.188Z"}}], "cna": {"title": "net/sched: act_gact, act_police: range check the fallback control action", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "5f038affdacaffedf6a85a06cf59ec0a852d36a7", "versionType": "git"}, {"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4", "versionType": "git"}, {"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "725efc2ab4a40affc4e285a2dc4896d103948a6c", "versionType": "git"}, {"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "6bcb8839aa2d686964a4154650afc4db91e1c514", "versionType": "git"}, {"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "5344e01179baa37547ab29fd7b8614f83faa190c", "versionType": "git"}, {"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "92f00f1d4d204a428b38e26fce3baee144b6955d", "versionType": "git"}, {"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "2e8df8c9190335475a3b64a159d3efd8cdd1cb73", "versionType": "git"}, {"status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "lessThan": "883b56ae58fe657d8497806c7059646e9ba6dbd0", "versionType": "git"}], "programFiles": ["include/net/act_api.h", "net/sched/act_gact.c", "net/sched/act_police.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/act_api.h", "net/sched/act_gact.c", "net/sched/act_police.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7"}, {"url": "https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4"}, {"url": "https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c"}, {"url": "https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514"}, {"url": "https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c"}, {"url": "https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d"}, {"url": "https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73"}, {"url": "https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gact, act_police: range check the fallback control action\n\ntcf_action_check_ctrlact() range checks the primary control action:\n\n\tif (!opcode)\n\t\tret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\n\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\n\nBoth are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\n\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow 'goto chain' on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow 'goto chain' on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\n\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\n\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.266", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:46.379Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74620", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:05:49.005Z", "dateReserved": "2026-08-15T05:44:03.921Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:04.254Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/act_api.h", "net/sched/act_gact.c", "net/sched/act_police.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5f038affdacaffedf6a85a06cf59ec0a852d36a7", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}, {"lessThan": "efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}, {"lessThan": "725efc2ab4a40affc4e285a2dc4896d103948a6c", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}, {"lessThan": "6bcb8839aa2d686964a4154650afc4db91e1c514", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}, {"lessThan": "5344e01179baa37547ab29fd7b8614f83faa190c", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}, {"lessThan": "92f00f1d4d204a428b38e26fce3baee144b6955d", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}, {"lessThan": "2e8df8c9190335475a3b64a159d3efd8cdd1cb73", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}, {"lessThan": "883b56ae58fe657d8497806c7059646e9ba6dbd0", "status": "affected", "version": "720f22fed81bc6fd1765db7014651b6718887bea", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/act_api.h", "net/sched/act_gact.c", "net/sched/act_police.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gact, act_police: range check the fallback control action\n\ntcf_action_check_ctrlact() range checks the primary control action:\n\n\tif (!opcode)\n\t\tret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\n\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\n\nBoth are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\n\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow 'goto chain' on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow 'goto chain' on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\n\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\n\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/sched: act_gact, act_police: comprobaci\u00f3n de rango de la acci\u00f3n de control de reserva\n\ntcf_action_check_ctrlact() comprueba el rango de la acci\u00f3n de control primaria:\n\n\tsi (!opcode)\n\t\tret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX es TC_ACT_TRAP, por lo que los veredictos internos del kernel por encima de este no pueden establecerse de esa manera. Pero act_gact y act_police cada uno lleva una segunda acci\u00f3n de control independiente suministrada por el espacio de usuario que nunca llega a ese ayudante - TCA_GACT_PROB.paction y TCA_POLICE_RESULT. Ambos solo rechazan TC_ACT_GOTO_CHAIN, por lo que cualquier otro valor se almacena textualmente y se devuelve textualmente de la acci\u00f3n.\n\nEn particular, el espacio de usuario puede almacenar TC_ACT_CONSUMED, que es TC_ACT_VALUE_MAX + 1 y deliberadamente no forma parte del rango de valores de la UAPI. Ese veredicto le dice a cada llamador que la acci\u00f3n tom\u00f3 posesi\u00f3n del skb, por lo que nadie lo libera: sch_handle_ingress(), sch_handle_egress() y tcf_qevent_handle() todos omiten deliberadamente la liberaci\u00f3n para ello. El resultado es un sk_buff filtrado m\u00e1s su b\u00fafer de datos por cada paquete que atraviesa el filtro, sin l\u00edmites, para todo el tr\u00e1fico en la cadena, incluidos los paquetes generados por el kernel.\n\nAmbos son trivialmente deterministas. act_gact limita tcfg_pval a >= 1, por lo que con pval = 1 gact_determ() devuelve la reserva para cada paquete. act_police no tiene una tasa obligatoria, por lo que rate = 0 deja tcfp_mtu = ~0 y tcf_police_mtu_check() siempre pasa.\n\nTC_ACT_CONSUMED fue a\u00f1adido por el commit 720f22fed81b ('net: sched: refactor reinsert action'), despu\u00e9s de que se escribieran ambos guardas de goto-chain:\ncommit 9469f375ab09 ('net/sched: act_gact: disallow 'goto chain' on fallback control action') y\ncommit c08f5ed5d625 ('net/sched: act_police: disallow 'goto chain' on fallback control action'). Ninguno de los guardas fue ampliado cuando apareci\u00f3 el nuevo veredicto.\n\nFactorizar la prueba de rango existente de tcf_action_check_ctrlact() como tcf_action_valid() y aplicarla a ambas reservas. El ayudante no puede llamar a tcf_action_check_ctrlact() directamente porque eso tambi\u00e9n asigna un goto_chain, que es exactamente lo que estos dos sitios no deben hacer.\n\nReproducido en v7.2-rc6: kmemleak informa de un objeto skbuff_head_cache de 232 bytes filtrado m\u00e1s su b\u00fafer de datos de 704 bytes por paquete. Con este parche ambas configuraciones son rechazadas con -EINVAL y kmemleak no informa de ninguno."}], "id": "CVE-2026-74620", "lastModified": "2026-11-06T17:19:51.650", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74620", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:00:00.692905Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:34.753", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/sched: act_gact, act_police: range check the fallback control action", "id": "2521482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521482"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/sched: act_gact, act_police: range check the fallback control action\ntcf_action_check_ctrlact() range checks the primary control action:\nif (!opcode)\nret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\nBoth are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow 'goto chain' on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow 'goto chain' on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none.", "A flaw was found in the Linux kernel's net/sched subsystem, specifically within the act_gact and act_police modules. A local user could exploit this vulnerability by providing a specially crafted control action that bypasses proper range checks. This improper handling of control actions leads to an unbounded memory leak, where sk_buff objects and their data buffers are not freed. Consequently, this can result in a denial of service (DoS) for the system."], "name": "CVE-2026-74620", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74620\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74620\nhttps://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74620-9726@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[720f22fed81bc6fd1765db7014651b6718887bea,efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[720f22fed81bc6fd1765db7014651b6718887bea,725efc2ab4a40affc4e285a2dc4896d103948a6c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[720f22fed81bc6fd1765db7014651b6718887bea,6bcb8839aa2d686964a4154650afc4db91e1c514)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[720f22fed81bc6fd1765db7014651b6718887bea,5344e01179baa37547ab29fd7b8614f83faa190c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[720f22fed81bc6fd1765db7014651b6718887bea,92f00f1d4d204a428b38e26fce3baee144b6955d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[720f22fed81bc6fd1765db7014651b6718887bea,2e8df8c9190335475a3b64a159d3efd8cdd1cb73)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[720f22fed81bc6fd1765db7014651b6718887bea,883b56ae58fe657d8497806c7059646e9ba6dbd0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T16:45:03.759330+00:00", "updated": "2026-08-25T17:00:04.120503+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}