CVE-2026-74620 Overview
CVE-2026-74620 is a memory leak vulnerability in the Linux kernel's traffic control subsystem. The flaw affects the act_gact and act_police traffic control actions in net/sched. User space can supply a fallback control action value that bypasses the primary range check performed by tcf_action_check_ctrlact(). Specifically, the TCA_GACT_PROB.paction and TCA_POLICE_RESULT attributes accept TC_ACT_CONSUMED, a kernel-internal verdict outside the UAPI value range. When returned, this verdict tells callers the action took ownership of the sk_buff, so no code path frees it. The result is an unbounded sk_buff leak on every packet traversing the affected filter chain.
Critical Impact
A local user with CAP_NET_ADMIN can trigger an unbounded kernel memory leak, exhausting system memory and causing denial of service on any traffic passing through the filter chain.
Affected Products
- Linux kernel with CONFIG_NET_SCHED enabled prior to the fix
- Kernel versions containing commit 720f22fed81b ("net: sched: refactor reinsert action") through v7.2-rc6
- Distributions shipping vulnerable stable kernel branches
Discovery Timeline
- 2026-08-22 - CVE-2026-74620 published to NVD
- 2026-08-23 - Last updated in NVD database
Technical Details for CVE-2026-74620
Vulnerability Analysis
The vulnerability resides in the Linux traffic control action framework. The helper tcf_action_check_ctrlact() enforces the range action <= TC_ACT_VALUE_MAX on the primary control action, where TC_ACT_VALUE_MAX equals TC_ACT_TRAP. This check prevents user space from setting kernel-internal verdicts through the primary action path.
However, act_gact and act_police each accept a second, independent control action from user space through TCA_GACT_PROB.paction and TCA_POLICE_RESULT. These values never reach tcf_action_check_ctrlact(). The existing validation only rejects TC_ACT_GOTO_CHAIN, allowing any other value to be stored and returned verbatim.
Root Cause
When commit 720f22fed81b introduced TC_ACT_CONSUMED (value TC_ACT_VALUE_MAX + 1), the earlier goto-chain guards in commits 9469f375ab09 and c08f5ed5d625 were not widened to reject the new verdict. TC_ACT_CONSUMED signals that the action assumed ownership of the skb. Callers sch_handle_ingress(), sch_handle_egress(), and tcf_qevent_handle() deliberately skip freeing the buffer for this verdict, producing one leaked sk_buff per packet.
Attack Vector
Exploitation is deterministic and requires only the ability to create traffic control filters, typically CAP_NET_ADMIN. For act_gact, setting tcfg_pval = 1 causes gact_determ() to return the fallback for every packet. For act_police, omitting a rate leaves tcfp_mtu = ~0, so tcf_police_mtu_check() always passes. An attacker configures the fallback action to TC_ACT_CONSUMED and every packet traversing the chain leaks a 232-byte skbuff_head_cache object plus its 704-byte data buffer, as confirmed by kmemleak on v7.2-rc6.
Refer to the kernel commit 5344e01 and kernel commit 92f00f1 for the corrective patches.
Detection Methods for CVE-2026-74620
Indicators of Compromise
- Steady growth in skbuff_head_cache slab consumption reported by /proc/slabinfo without a matching traffic anomaly.
- kmemleak reports referencing leaked sk_buff allocations tied to net/sched action paths.
- tc filter rules configured with act_gact or act_police whose fallback control action decodes to value 8 (TC_ACT_CONSUMED).
Detection Strategies
- Audit installed traffic control policies with tc -s filter show and inspect fallback verdicts in act_gact and act_police rules.
- Correlate kernel memory pressure events with recent tc netlink activity from unprivileged namespaces or containers.
- Enable kmemleak (CONFIG_DEBUG_KMEMLEAK) on test hosts to observe reproducible leaks when malicious filters are installed.
Monitoring Recommendations
- Track slab allocator metrics for skbuff_head_cache and data buffer pools over time to catch unbounded growth.
- Log all RTM_NEWTFILTER and RTM_NEWACTION netlink operations along with the requesting UID and network namespace.
- Alert on containers or user namespaces holding CAP_NET_ADMIN that install act_gact or act_police rules.
How to Mitigate CVE-2026-74620
Immediate Actions Required
- Apply the upstream kernel patches that introduce tcf_action_valid() and enforce the range check on both fallback control actions.
- Restrict CAP_NET_ADMIN in untrusted containers and user namespaces to prevent installation of malicious tc filters.
- Review existing tc configurations and remove any act_gact or act_police rules with fallback verdicts outside the documented UAPI range.
Patch Information
The fix factors the existing range test out of tcf_action_check_ctrlact() into a new helper tcf_action_valid() and applies it to both fallback control action sites. Stable-tree backports are available in commits 2e8df8c, 5344e01, 5f038af, 6bcb883, 725efc2, 883b56a, 92f00f1, and efa58ae. After patching, both offending configurations are rejected with -EINVAL.
Workarounds
- Disable unprivileged user namespaces where feasible using sysctl kernel.unprivileged_userns_clone=0 on distributions that support the toggle.
- Drop CAP_NET_ADMIN from container profiles that do not require traffic control configuration, for example through seccomp or Kubernetes securityContext.
- Remove or replace any act_gact filter using tcfg_pval = 1 and any act_police filter configured without a rate until the kernel is patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
