CVE-2026-74620 - Vulnerability Details

- net/sched: act_gact, act_police: range check the fallback control action

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_gact, act_police: range check the fallback control action

tcf_action_check_ctrlact() range checks the primary control action:

if (!opcode)
ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;

TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it
cannot be set that way. But act_gact and act_police each carry a second,
independent control action supplied by user space that never reaches that
helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject
TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned
verbatim from the action.

In particular user space can store TC_ACT_CONSUMED, which is
TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value
range. That verdict tells every caller the action took ownership of the
skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and
tcf_qevent_handle() all deliberately skip the free for it. The result is
one leaked sk_buff plus its data buffer per packet traversing the filter,
unbounded, for all traffic on the chain including kernel-generated
packets.

Both are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so
with pval = 1 gact_determ() returns the fallback for every packet.
act_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and
tcf_police_mtu_check() always passes.

TC_ACT_CONSUMED was added by commit 720f22fed81b ("net: sched: refactor
reinsert action"), after both goto-chain guards were written:
commit 9469f375ab09 ("net/sched: act_gact: disallow 'goto chain' on
fallback control action") and
commit c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on
fallback control action"). Neither guard was widened when the new
verdict appeared.

Factor the existing range test out of tcf_action_check_ctrlact() as
tcf_action_valid() and apply it to both fallbacks. The helper cannot call
tcf_action_check_ctrlact() directly because that also allocates a
goto_chain, which is exactly what these two sites must not do.

Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte
skbuff_head_cache object plus its 704-byte data buffer per packet. With
this patch both configurations are rejected with -EINVAL and kmemleak
reports none.

Published: 2026-08-22

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel’s network scheduler modules allows a user space application to configure ‘act_gact’ or ‘act_police’ actions with a control action value that bypasses the kernel’s range checks. The value TC_ACT_CONSUMED causes the kernel to treat the packet as owned and skips freeing, resulting in a sk_buff and data buffer leak for every packet that passes through the filter. The leak is deterministic and unbounded, creating a severe resource exhaustion risk that can lead to kernel memory depletion and a denial of service.

Affected Systems

The vulnerability exists in the Linux kernel’s net/sched subsystem. All kernel versions prior to the patch that implements proper range validation are affected, including the 7.2‑rc6 release and older stable releases. The affected products are generic Linux kernels; no specific vendor version list is available beyond the kernel code base.

Risk and Exploitability

The flaw is high‑severity due to its ability to exhaust system memory. No EPSS data is available, but the deterministic nature of the leak makes exploitation highly likely if the configuration flaw can be introduced. The vulnerability is not listed in CISA KEV. Attackers would need the ability to manipulate network filter configurations, which typically requires privileged (root) access, but it could be leveraged indirectly by compromising services that adjust these filters.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`720f22fed81bc6fd1765db7014651b6718887bea`	affected	< efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4
`720f22fed81bc6fd1765db7014651b6718887bea`	affected	< 725efc2ab4a40affc4e285a2dc4896d103948a6c
`720f22fed81bc6fd1765db7014651b6718887bea`	affected	< 6bcb8839aa2d686964a4154650afc4db91e1c514
`720f22fed81bc6fd1765db7014651b6718887bea`	affected	< 5344e01179baa37547ab29fd7b8614f83faa190c
`720f22fed81bc6fd1765db7014651b6718887bea`	affected	< 92f00f1d4d204a428b38e26fce3baee144b6955d
`720f22fed81bc6fd1765db7014651b6718887bea`	affected	< 2e8df8c9190335475a3b64a159d3efd8cdd1cb73
`720f22fed81bc6fd1765db7014651b6718887bea`	affected	< 883b56ae58fe657d8497806c7059646e9ba6dbd0

Linux

affected

Version	Status	Constraints
`5.3`	affected	—
`0`	unaffected	< 5.3
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[720f22fed81bc6fd1765db7014651b6718887bea,efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4)`	affected	code_commit	—
`[720f22fed81bc6fd1765db7014651b6718887bea,725efc2ab4a40affc4e285a2dc4896d103948a6c)`	affected	code_commit	—
`[720f22fed81bc6fd1765db7014651b6718887bea,6bcb8839aa2d686964a4154650afc4db91e1c514)`	affected	code_commit	—
`[720f22fed81bc6fd1765db7014651b6718887bea,5344e01179baa37547ab29fd7b8614f83faa190c)`	affected	code_commit	—
`[720f22fed81bc6fd1765db7014651b6718887bea,92f00f1d4d204a428b38e26fce3baee144b6955d)`	affected	code_commit	—
`[720f22fed81bc6fd1765db7014651b6718887bea,2e8df8c9190335475a3b64a159d3efd8cdd1cb73)`	affected	code_commit	—
`[720f22fed81bc6fd1765db7014651b6718887bea,883b56ae58fe657d8497806c7059646e9ba6dbd0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.3`	affected	generic	—
`[0,5.3)`	unaffected	generic	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the security patch for act_gact and act_police range validation.
If an upgrade cannot be performed immediately, remove or disable act_gact and act_police filter chains from all network configurations to eliminate the vulnerability.
Continuously monitor system memory usage and kernel logs for abnormal sk_buff allocation patterns to detect any attempted exploitation early.

Generated by OpenCVE AI on August 22, 2026 at 16:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73
https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c
https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514
https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c
https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0
https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d
https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4

History

Sat, 22 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-399 CWE-401

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0; TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it cannot be set that way. But act_gact and act_police each carry a second, independent control action supplied by user space that never reaches that helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned verbatim from the action. In particular user space can store TC_ACT_CONSUMED, which is TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value range. That verdict tells every caller the action took ownership of the skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for it. The result is one leaked sk_buff plus its data buffer per packet traversing the filter, unbounded, for all traffic on the chain including kernel-generated packets. Both are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so with pval = 1 gact_determ() returns the fallback for every packet. act_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and tcf_police_mtu_check() always passes. TC_ACT_CONSUMED was added by commit 720f22fed81b ("net: sched: refactor reinsert action"), after both goto-chain guards were written: commit 9469f375ab09 ("net/sched: act_gact: disallow 'goto chain' on fallback control action") and commit c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on fallback control action"). Neither guard was widened when the new verdict appeared. Factor the existing range test out of tcf_action_check_ctrlact() as tcf_action_valid() and apply it to both fallbacks. The helper cannot call tcf_action_check_ctrlact() directly because that also allocates a goto_chain, which is exactly what these two sites must not do. Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet. With this patch both configurations are rejected with -EINVAL and kmemleak reports none.
Title		net/sched: act_gact, act_police: range check the fallback control action
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73 https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514 https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0 https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:04.254Z

Updated: 2026-08-22T15:32:04.254Z

Reserved: 2026-08-15T05:44:03.921Z

Link: CVE-2026-74620

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:34.753

Modified: 2026-08-22T16:16:34.753

Link: CVE-2026-74620

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-22T18:15:03Z

Weaknesses

CWE-20
Improper Input Validation
CWE-399
CWE-401
Missing Release of Memory after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object