CVE-2026-74620— net/sched: act_gact, act_police: range check the fallback control action
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： net/sched: act_gact, act_police：对回退控制动作执行范围检查 函数会对主控制动作执行范围检查： 其中 等于 ，因此通过此方式无法设置高于该值的内核内部判决（verdict）。然而， 和 各自携带一个由用户空间提供的第二独立控制动作，该动作不会经过上述辅助函数处理——即 和 。这两者仅拒绝 ，其他任何值都会原封不动地存储并原封不动地从动作中返回。 特别是，用户空间可以存储 ，该值等于 ，且明确不属于用户 API（UAPI）允许的值范围。该判决会告
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 720f22fed81bc6fd1765db7014651b6718887bea< 5f038affdacaffedf6a85a06cf59ec0a852d36a7 |
affected |
720f22fed81bc6fd1765db7014651b6718887bea< efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4 |
affected | ||
720f22fed81bc6fd1765db7014651b6718887bea< 725efc2ab4a40affc4e285a2dc4896d103948a6c |
affected | ||
720f22fed81bc6fd1765db7014651b6718887bea< 6bcb8839aa2d686964a4154650afc4db91e1c514 |
affected | ||
720f22fed81bc6fd1765db7014651b6718887bea< 5344e01179baa37547ab29fd7b8614f83faa190c |
affected | ||
720f22fed81bc6fd1765db7014651b6718887bea< 92f00f1d4d204a428b38e26fce3baee144b6955d |
affected | ||
720f22fed81bc6fd1765db7014651b6718887bea< 2e8df8c9190335475a3b64a159d3efd8cdd1cb73 |
affected | ||
720f22fed81bc6fd1765db7014651b6718887bea< 883b56ae58fe657d8497806c7059646e9ba6dbd0 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74620
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/sched: act_gact, act_police: range check the fallback control action
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_gact, act_police: range check the fallback control action
tcf_action_check_ctrlact() range checks the primary control action:
if (!opcode)
ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;
TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it
cannot be set that way. But act_gact and act_police each carry a second,
independent control action supplied by user space that never reaches that
helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject
TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned
verbatim from the action.
In particular user space can store TC_ACT_CONSUMED, which is
TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value
range. That verdict tells every caller the action took ownership of the
skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and
tcf_qevent_handle() all deliberately skip the free for it. The result is
one leaked sk_buff plus its data buffer per packet traversing the filter,
unbounded, for all traffic on the chain including kernel-generated
packets.
Both are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so
with pval = 1 gact_determ() returns the fallback for every packet.
act_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and
tcf_police_mtu_check() always passes.
TC_ACT_CONSUMED was added by commit 720f22fed81b ("net: sched: refactor
reinsert action"), after both goto-chain guards were written:
commit 9469f375ab09 ("net/sched: act_gact: disallow 'goto chain' on
fallback control action") and
commit c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on
fallback control action"). Neither guard was widened when the new
verdict appeared.
Factor the existing range test out of tcf_action_check_ctrlact() as
tcf_action_valid() and apply it to both fallbacks. The helper cannot call
tcf_action_check_ctrlact() directly because that also allocates a
goto_chain, which is exactly what these two sites must not do.
Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte
skbuff_head_cache object plus its 704-byte data buffer per packet. With
this patch both configurations are rejected with -EINVAL and kmemleak
reports none.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74620
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74620
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74620 (7)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74705 | 10.0 CRITICAL | udp: fix potential use-after-free in tunnel segmentation |
| CVE-2026-74612 | 10.0 CRITICAL | veth: fix skb length accounting after XDP frag adjustment |
| CVE-2026-74616 | 9.8 CRITICAL | xdp: reject clones that overrun skb_shared_info tailroom |
| CVE-2026-74617 | 9.8 CRITICAL | dibs: initialise dibs->lock in dibs_dev_alloc() |
| CVE-2026-74597 | 9.8 CRITICAL | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() |
| CVE-2026-74688 | 9.8 CRITICAL | sctp: clear control chunk transport if it is being removed |
| CVE-2026-74608 | 9.8 CRITICAL | smb: client: Fix use-after-free in cifs_try_adding_channels() |
| CVE-2026-74669 | 9.8 CRITICAL | ipvs: clear IPv4 options after rebasing tunnel ICMP errors |
| CVE-2026-74662 | 9.8 CRITICAL | inet: frags: publish queues before arming timer |
| CVE-2026-74591 | 9.8 CRITICAL | mm/filemap: __filemap_add_folio() restore index before retrying |
| CVE-2026-74628 | 9.8 CRITICAL | net/x25: fix use-after-free of the socket by its timers |
| CVE-2026-74587 | 9.8 CRITICAL | sctp: fix use-after-free of cached ASCONF chunk |
| CVE-2026-74588 | 9.8 CRITICAL | sctp: keep chunk->transport in step with the list it is queued on |
| CVE-2026-74730 | 9.8 CRITICAL | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call |
| CVE-2026-74727 | 9.8 CRITICAL | ovpn: skip rehash for peers already removed from by_id |
| CVE-2026-74611 | 9.8 CRITICAL | tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| CVE-2026-74586 | 9.8 CRITICAL | sctp: clear new_transport when removing a peer |
| CVE-2026-74723 | 9.8 CRITICAL | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-74712 | 9.3 CRITICAL | vdpa/mlx5: Fix buffer length in create_direct_keys() |
| CVE-2026-74665 | 9.1 CRITICAL | net: fix skb length accounting after generic XDP frag adjustment |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-80589
block: stop the timeout timer when releasing a never added d -
CVE-2026-80588
mptcp: reclaim forward-allocated memory on RX path errors -
CVE-2026-80587
mptcp: avoid combining some incoming suboptions -
CVE-2026-80586
mptcp: options: reset DSS fields in case of unexpected size -
CVE-2026-80585
mptcp: fastopen: only mark MPTFO subflows with SYN data
Same vendor: Linux
-
CVE-2026-80589
block: stop the timeout timer when releasing a never added d -
CVE-2026-80588
mptcp: reclaim forward-allocated memory on RX path errors -
CVE-2026-80587
mptcp: avoid combining some incoming suboptions -
CVE-2026-80586
mptcp: options: reset DSS fields in case of unexpected size -
CVE-2026-80585
mptcp: fastopen: only mark MPTFO subflows with SYN data
V. Comments for CVE-2026-74620
No comments yet