CVE-2026-74621: Linux Kernel Information Disclosure Vulnerability

CVE-2026-74621 Overview

CVE-2026-74621 is a memory leak vulnerability in the Linux kernel's net/sched subsystem, specifically in the act_ct connection tracking action. The flaw resides in tcf_ct_handle_fragments(), which fails to release an sk_buff when header sanity checks reject a malformed packet before defragmentation. Each rejected packet leaks one skbuff_head_cache object plus its data buffer, and the leak is unbounded across attacker-supplied traffic. A remote attacker sending malformed IPv4 or IPv6 fragments to an ingress interface configured with action ct can exhaust kernel memory and cause denial of service.

Critical Impact
Remote, unauthenticated attackers can trigger unbounded kernel memory exhaustion by sending malformed fragmented packets to systems using tc action ct, leading to denial of service.

Affected Products

Linux kernel versions containing the regression prior to the fix commits listed in the kernel.org stable tree
Systems configured with traffic control clsact chains using action ct
Distributions shipping affected stable kernels until backports are applied

Discovery Timeline

2026-08-22 - CVE-2026-74621 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74621

Vulnerability Analysis

The tcf_ct_handle_fragments() function performs header sanity checks before handing packets to the defragmentation engine. tcf_ct_ipv4_is_fragment() can return -EINVAL or -ENOMEM, and tcf_ct_ipv6_is_fragment() additionally returns -EPROTO when ipv6_find_hdr() fails. None of these error paths free or queue the sk_buff, so the caller retains ownership.

However, tcf_ct_act() funnels every non-zero return into the ownership-transfer exit at out_frag, returning TC_ACT_CONSUMED. This verdict signals to sch_handle_ingress(), sch_handle_egress(), and tcf_qevent_handle() that the action took ownership of the packet, so they deliberately skip the free. The sk_buff is therefore orphaned: one sk_buff plus its data buffer is leaked per malformed packet.

The drop counter is also incremented for these errors, so statistics report drops that never actually released memory. Three different ownership states can reach out_frag: queued by defrag (-EINPROGRESS), already freed by nf_ct_handle_fragments(), or still owned by the caller.

Root Cause

The root cause is an incorrect ownership-transfer assumption on error paths in tcf_ct_handle_fragments(). The function returns error codes without communicating whether the sk_buff has been consumed, while the caller unconditionally treats every non-zero return as ownership transfer via TC_ACT_CONSUMED. This is a resource leak [CWE-401] introduced by an earlier commit that changed the return-value contract without updating callers.

Attack Vector

An attacker sends malformed fragmented packets to an interface running a clsact ingress chain with action ct. The reproducer described in the kernel commit is a 54-byte frame carrying a 40-byte IPv6 header with nexthdr = 0 (hop-by-hop) and no following payload. kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet. Sustained traffic drives kernel memory exhaustion and system instability.

See the upstream fix in Kernel Commit 47d9982 for the exact code changes that restore correct ownership signalling and free the packet in the caller when appropriate.

Detection Methods for CVE-2026-74621

Indicators of Compromise

Steadily growing skbuff_head_cache slab usage visible in /proc/slabinfo on hosts running tc action ct
kmemleak reports referencing leaked 232-byte skbuff_head_cache objects with 704-byte data buffers
Rising tc -s action show action ct drop counters without corresponding released memory
Sudden kernel Out of memory events on systems processing untrusted fragmented traffic

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and scan for sk_buff leaks under fragment-heavy workloads
Monitor slab allocator statistics for unbounded growth in skbuff_head_cache correlated with ingress traffic
Inspect tc action rulesets on production hosts to identify chains using action ct exposed to untrusted networks

Monitoring Recommendations

Alert on kernel memory growth trends against a baseline for hosts running connection-tracking tc actions
Capture and analyze malformed IPv6 packets with nexthdr = 0 and no payload at edge inspection points
Forward kernel logs and slab metrics to a centralized data lake for longitudinal analysis and anomaly detection

How to Mitigate CVE-2026-74621

Immediate Actions Required

Apply the stable kernel updates containing the upstream fix commits to all affected hosts
Audit tc configurations and identify every interface using action ct on internet-facing or untrusted segments
Prioritize patching on routers, load balancers, and container hosts that terminate untrusted traffic

Patch Information

The fix has been merged into the stable kernel tree across multiple branches. Relevant commits include Kernel Commit 47d9982, Kernel Commit 23e97d5, Kernel Commit 439d3e4, Kernel Commit 737873a, Kernel Commit 8a7ed56, Kernel Commit b47bb89, and Kernel Commit b5dbecc. The patch makes tcf_ct_handle_fragments() signal ownership state to callers and frees the sk_buff when the caller still owns it, restoring the prior TC_ACT_SHOT behavior.

Workarounds

Remove action ct from tc rules on interfaces exposed to untrusted traffic until patched kernels are deployed
Filter malformed IPv6 packets containing hop-by-hop headers with no payload at upstream network devices
Rate-limit fragmented traffic at the edge to slow the leak rate on systems that cannot be immediately updated

bash

# Identify tc chains using action ct that require patching
tc -s filter show dev eth0 ingress | grep -A2 'action ct'

# Temporary removal of the affected action on an interface
tc filter del dev eth0 ingress