CVE-2026-74621

net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

Published Aug 22, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

tcf_ct_handle_fragments() runs its header sanity checks before handing
anything to the defragmentation engine:

if (family == NFPROTO_IPV4)
err = tcf_ct_ipv4_is_fragment(skb, &frag);
else
err = tcf_ct_ipv6_is_fragment(skb, &frag);
if (err || !frag)
return err;

tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM;
tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of
them frees or queues the skb, so on that path the caller still owns it.

tcf_ct_act() however funnels every non-zero return into the
ownership-transfer exit:

err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);
if (err)
goto out_frag;
...
out_frag:
if (err != -EINPROGRESS)
tcf_action_inc_drop_qstats(&c->common);
return TC_ACT_CONSUMED;

TC_ACT_CONSUMED means the action took ownership of the skb, so no caller
frees it - sch_handle_ingress(), sch_handle_egress() and
tcf_qevent_handle() all deliberately skip the free for that verdict. The
skb is therefore orphaned: one sk_buff plus its data buffer is leaked per
malformed packet, unbounded. Note the drop counter is already incremented
for these errors, so the statistics claim a drop that never happens.

Three different ownership states reach out_frag: today - the skb may be
queued by the defrag engine (-EINPROGRESS), already freed by
nf_ct_handle_fragments(), or still owned by us. Tell the caller which of
those it is, and free the packet ourselves in the last case, which
restores the TC_ACT_SHOT behaviour that predated the Fixes: commit.

Reproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6
header with nexthdr = 0 (hop-by-hop) and nothing after it, on a
clsact ingress chain with "action ct". kmemleak reports one leaked
232-byte skbuff_head_cache object plus its 704-byte data buffer per
packet; with this patch it reports none.

Analysis

Technical impact

The Linux kernel’s act_ct action module fails to free sk_buff structures when header sanity checks reject a packet, resulting in orphaned sk_buff and data buffers. Each malformed packet leaves one sk_buff and its payload unreclaimed, leading to an unbounded memory leak. The kernel’s drop statistics also incorrectly report a drop for packets that were never processed, potentially masking denial of service conditions.

Affected Systems

All Linux kernels that implement the act_ct action in the traffic control subsystem are affected, as demonstrated in version 7.2‑rc6 and earlier releases. The vulnerability applies to any distribution shipping the stock kernel without the patch, regardless of kernel version, until the flaw is remedied.

Risk and Exploitability

Although the vulnerability does not grant remote code execution or privilege escalation, the exploit path is straightforward: an attacker can send crafted IPv4 or IPv6 fragments that trigger the header checks, causing the kernel to leak memory. The CVSS score is 7.5 and the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, but the lack of an automatic free directly consumes kernel memory, potentially degrading or exhausting system resources. The attack vector is network‑based, originating from malformed packets observed on the affected host’s network interface.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`172ba7d46c202e679f3ccb10264c67416aaeb1c4`	affected	< b5dbecc2016e1692fd1c2532af9c41ba729cb747
`0b5b831122fc3789fff75be433ba3e4dd7b779d4`	affected	< 23e97d594ddd0153020c506d5041048fbde1beb4
`73f7da5fd124f2cda9161e2e46114915e6e82e97`	affected	< 737873a59905a54ca0d2d127ef882f3f88bf4379
`3f14b377d01d8357eba032b4cabc8c1149b458b6`	affected	< 47d99828591d0fe8be4b9c8992ff3b8e47968db9
`3f14b377d01d8357eba032b4cabc8c1149b458b6`	affected	< b47bb899e04b5407c5a63fe88d4b6676586a6e84
`3f14b377d01d8357eba032b4cabc8c1149b458b6`	affected	< 439d3e404f9d5e515911cc8132cde198b337c19e
`3f14b377d01d8357eba032b4cabc8c1149b458b6`	affected	< 8a7ed561671aa6a911a2de99e59ef670a4d0b1df
`f5346df0591d10bc948761ca854b1fae6d2ef441`	affected	—
`5.15.148`	affected	< 5.15.217
`6.1.75`	affected	< 6.1.184
`6.6.14`	affected	< 6.6.152
`6.7.2`	affected	< 6.8

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[73f7da5fd124f2cda9161e2e46114915e6e82e97,737873a59905a54ca0d2d127ef882f3f88bf4379)`	affected	code_commit	—
`[3f14b377d01d8357eba032b4cabc8c1149b458b6,47d99828591d0fe8be4b9c8992ff3b8e47968db9)`	affected	code_commit	—
`[3f14b377d01d8357eba032b4cabc8c1149b458b6,b47bb899e04b5407c5a63fe88d4b6676586a6e84)`	affected	code_commit	—
`[3f14b377d01d8357eba032b4cabc8c1149b458b6,439d3e404f9d5e515911cc8132cde198b337c19e)`	affected	code_commit	—
`[3f14b377d01d8357eba032b4cabc8c1149b458b6,8a7ed561671aa6a911a2de99e59ef670a4d0b1df)`	affected	code_commit	—
`172ba7d46c202e679f3ccb10264c67416aaeb1c4`	affected	code_commit	—
`0b5b831122fc3789fff75be433ba3e4dd7b779d4`	affected	code_commit	—
`f5346df0591d10bc948761ca854b1fae6d2ef441`	affected	code_commit	—
`[6.6.14,6.6.152)`	affected	semver	—
`[5.15.148,5.16)`	affected	semver	—
`[6.1.75,6.2)`	affected	semver	—
`[6.7.2,6.8)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.8`	affected	semver	—
`[0,6.8)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that incorporates the act_ct sk_buff leak fix, such as any kernel released after the commit series referenced in the advisory.
If immediate upgrade is not possible, disable the clsact ingress chain or remove the act_ct action from traffic control rules to prevent the leak from being triggered.
Deploy firewall rules or packet filtering to block suspicious excessive or malformed fragment traffic before it reaches the kernel.

Generated by OpenCVE AI on August 25, 2026 at 08:29 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.490% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/23e97d594ddd0153020c506d5041048fbde1beb4
https://git.kernel.org/stable/c/439d3e404f9d5e515911cc8132cde198b337c19e
https://git.kernel.org/stable/c/47d99828591d0fe8be4b9c8992ff3b8e47968db9
https://git.kernel.org/stable/c/737873a59905a54ca0d2d127ef882f3f88bf4379
https://git.kernel.org/stable/c/8a7ed561671aa6a911a2de99e59ef670a4d0b1df
https://git.kernel.org/stable/c/b47bb899e04b5407c5a63fe88d4b6676586a6e84
https://git.kernel.org/stable/c/b5dbecc2016e1692fd1c2532af9c41ba729cb747
https://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74621-81bd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74621
https://www.cve.org/CVERecord?id=CVE-2026-74621

History

Oct 17, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 25, 2026 7:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-788

Aug 25, 2026 5:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Aug 24, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74621-81bd@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74621 https://www.cve.org/CVERecord?id=CVE-2026-74621
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Aug 23, 2026 1:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/23e97d594ddd0153020c506d5041048fbde1beb4 https://git.kernel.org/stable/c/b5dbecc2016e1692fd1c2532af9c41ba729cb747

Aug 22, 2026 7:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-788

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine: if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(skb, &frag); else err = tcf_ct_ipv6_is_fragment(skb, &frag); if (err \|\| !frag) return err; tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM; tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of them frees or queues the skb, so on that path the caller still owns it. tcf_ct_act() however funnels every non-zero return into the ownership-transfer exit: err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); if (err) goto out_frag; ... out_frag: if (err != -EINPROGRESS) tcf_action_inc_drop_qstats(&c->common); return TC_ACT_CONSUMED; TC_ACT_CONSUMED means the action took ownership of the skb, so no caller frees it - sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for that verdict. The skb is therefore orphaned: one sk_buff plus its data buffer is leaked per malformed packet, unbounded. Note the drop counter is already incremented for these errors, so the statistics claim a drop that never happens. Three different ownership states reach out_frag: today - the skb may be queued by the defrag engine (-EINPROGRESS), already freed by nf_ct_handle_fragments(), or still owned by us. Tell the caller which of those it is, and free the packet ourselves in the last case, which restores the TC_ACT_SHOT behaviour that predated the Fixes: commit. Reproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6 header with nexthdr = 0 (hop-by-hop) and nothing after it, on a clsact ingress chain with "action ct". kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet; with this patch it reports none.
Title		net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/439d3e404f9d5e515911cc8132cde198b337c19e https://git.kernel.org/stable/c/47d99828591d0fe8be4b9c8992ff3b8e47968db9 https://git.kernel.org/stable/c/737873a59905a54ca0d2d127ef882f3f88bf4379 https://git.kernel.org/stable/c/8a7ed561671aa6a911a2de99e59ef670a4d0b1df https://git.kernel.org/stable/c/b47bb899e04b5407c5a63fe88d4b6676586a6e84