CVE-2026-74740 Overview
CVE-2026-74740 is a time-of-check time-of-use (TOCTOU) race condition in the Linux kernel's net/sched traffic control action API. The flaw resides in tcf_action_exec(), which handles the TC_ACT_GOTO_CHAIN return code. The function performs two independent RCU reads of a->goto_chain, allowing a concurrent tcf_action_set_ctrlact() call (such as the gact replace path) to clear the pointer between the check and the dereference. The result is a NULL pointer dereference in kernel context when tcf_action_goto_chain_exec() accesses chain->filter_chain.
Critical Impact
A local attacker with CAP_NET_ADMIN privileges who can trigger concurrent traffic control action replacements can crash the kernel, causing a denial of service.
Affected Products
- Linux kernel (upstream)
- Distributions shipping vulnerable stable kernel branches referenced by the fix commits
- Systems using tc traffic control with TC_ACT_GOTO_CHAIN actions
Discovery Timeline
- 2026-08-26 - CVE-2026-74740 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74740
Vulnerability Analysis
The Linux kernel's traffic control subsystem allows filter actions to redirect packet processing to another chain using the TC_ACT_GOTO_CHAIN return code. The tcf_action_exec() function inspects a->goto_chain with rcu_access_pointer() and then calls tcf_action_goto_chain_exec(). The callee performs a second, independent rcu_dereference_bh() on the same pointer and immediately dereferences chain->filter_chain.
Between these two reads, another CPU can execute tcf_action_set_ctrlact() (for example, via the gact replace path) and clear a->goto_chain. The second read then returns NULL, and the subsequent field access dereferences a NULL pointer in softirq context. This produces a kernel oops and typically a system panic under panic_on_oops configurations.
Root Cause
The root cause is a split check/use pattern on an RCU-protected pointer. The initial rcu_access_pointer() verifies non-NULL, but the second rcu_dereference_bh() call in the helper function reads the pointer independently. RCU guarantees that a dereferenced pointer remains valid for the read-side critical section, but it does not guarantee that two separate reads of the same pointer return the same value if a writer publishes a new value between them.
Attack Vector
Triggering the race requires the ability to add and replace TC actions, which is gated by CAP_NET_ADMIN. An attacker holding this capability, or code running inside a network namespace with delegated networking privileges, can create a filter with a goto_chain action and repeatedly replace the action's control target while packets traverse the qdisc. Concurrent packet processing and control-plane updates race, eventually hitting the window between the check and the dereference.
The upstream fix consolidates the logic into a single rcu_dereference_bh() read in tcf_action_exec(), checks the result for NULL once, and passes the chain pointer into tcf_action_goto_chain_exec(). This converts the split check/use into a single check/use on one value. See the kernel patch series for the exact code changes.
Detection Methods for CVE-2026-74740
Indicators of Compromise
- Kernel oops or panic messages referencing tcf_action_goto_chain_exec or tcf_action_exec in the call stack
- NULL pointer dereference crash reports in dmesg originating from softirq or net_rx_action context
- Unexpected system reboots on hosts running high-volume tc filter chains with goto actions
Detection Strategies
- Monitor kernel ring buffer and crash dumps for NULL pointer dereferences tied to net/sched/act_api.c symbols
- Audit tc filter and tc action operations, especially replace operations on gact actions with goto chain targets
- Correlate CAP_NET_ADMIN usage from unprivileged network namespaces with kernel instability events
Monitoring Recommendations
- Ship kernel logs and kdump crash artifacts to a centralized log store for retrospective analysis
- Alert on repeated netlink messages of type RTM_NEWTFILTER or RTM_NEWACTION from non-administrative workloads
- Track kernel version inventory across the fleet to identify hosts still running unpatched stable branches
How to Mitigate CVE-2026-74740
Immediate Actions Required
- Apply the stable kernel updates that include the upstream fix commits to all affected hosts
- Restrict CAP_NET_ADMIN to trusted workloads and avoid granting it inside untrusted container or user namespaces
- Reboot hosts after patching to ensure the fixed kernel is active in memory
Patch Information
The fix is available in the following upstream and stable kernel commits: 1ec48b67, 6b70886e, 91d55fd1, abceabc4, and f60b396e. Distribution vendors are backporting the change to supported stable branches; consult your vendor advisory for the specific package version that includes the fix.
Workarounds
- Disable use of TC_ACT_GOTO_CHAIN actions in TC filter configurations where feasible
- Remove CAP_NET_ADMIN from container runtimes and unprivileged user namespaces on multi-tenant hosts
- Use seccomp or LSM policies to restrict netlink traffic control operations from untrusted processes
# Configuration example: drop CAP_NET_ADMIN from a systemd service
# to prevent tc action replacement from that unit
[Service]
CapabilityBoundingSet=~CAP_NET_ADMIN
AmbientCapabilities=
NoNewPrivileges=yes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
