CVE-2026-74620

{
  "id": "CVE-2026-74620",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-08-22T16:16:34.753",
  "lastModified": "2026-11-06T17:19:51.650",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gact, act_police: range check the fallback control action\n\ntcf_action_check_ctrlact() range checks the primary control action:\n\n\tif (!opcode)\n\t\tret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\n\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\n\nBoth are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\n\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow 'goto chain' on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow 'goto chain' on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\n\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\n\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/sched: act_gact, act_police: comprobación de rango de la acción de control de reserva\n\ntcf_action_check_ctrlact() comprueba el rango de la acción de control primaria:\n\n\tsi (!opcode)\n\t\tret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX es TC_ACT_TRAP, por lo que los veredictos internos del kernel por encima de este no pueden establecerse de esa manera. Pero act_gact y act_police cada uno lleva una segunda acción de control independiente suministrada por el espacio de usuario que nunca llega a ese ayudante - TCA_GACT_PROB.paction y TCA_POLICE_RESULT. Ambos solo rechazan TC_ACT_GOTO_CHAIN, por lo que cualquier otro valor se almacena textualmente y se devuelve textualmente de la acción.\n\nEn particular, el espacio de usuario puede almacenar TC_ACT_CONSUMED, que es TC_ACT_VALUE_MAX + 1 y deliberadamente no forma parte del rango de valores de la UAPI. Ese veredicto le dice a cada llamador que la acción tomó posesión del skb, por lo que nadie lo libera: sch_handle_ingress(), sch_handle_egress() y tcf_qevent_handle() todos omiten deliberadamente la liberación para ello. El resultado es un sk_buff filtrado más su búfer de datos por cada paquete que atraviesa el filtro, sin límites, para todo el tráfico en la cadena, incluidos los paquetes generados por el kernel.\n\nAmbos son trivialmente deterministas. act_gact limita tcfg_pval a >= 1, por lo que con pval = 1 gact_determ() devuelve la reserva para cada paquete. act_police no tiene una tasa obligatoria, por lo que rate = 0 deja tcfp_mtu = ~0 y tcf_police_mtu_check() siempre pasa.\n\nTC_ACT_CONSUMED fue añadido por el commit 720f22fed81b ('net: sched: refactor reinsert action'), después de que se escribieran ambos guardas de goto-chain:\ncommit 9469f375ab09 ('net/sched: act_gact: disallow 'goto chain' on fallback control action') y\ncommit c08f5ed5d625 ('net/sched: act_police: disallow 'goto chain' on fallback control action'). Ninguno de los guardas fue ampliado cuando apareció el nuevo veredicto.\n\nFactorizar la prueba de rango existente de tcf_action_check_ctrlact() como tcf_action_valid() y aplicarla a ambas reservas. El ayudante no puede llamar a tcf_action_check_ctrlact() directamente porque eso también asigna un goto_chain, que es exactamente lo que estos dos sitios no deben hacer.\n\nReproducido en v7.2-rc6: kmemleak informa de un objeto skbuff_head_cache de 232 bytes filtrado más su búfer de datos de 704 bytes por paquete. Con este parche ambas configuraciones son rechazadas con -EINVAL y kmemleak no informa de ninguno."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_gact.c",
            "net/sched/act_police.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "5f038affdacaffedf6a85a06cf59ec0a852d36a7",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "725efc2ab4a40affc4e285a2dc4896d103948a6c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "6bcb8839aa2d686964a4154650afc4db91e1c514",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "5344e01179baa37547ab29fd7b8614f83faa190c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "92f00f1d4d204a428b38e26fce3baee144b6955d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "2e8df8c9190335475a3b64a159d3efd8cdd1cb73",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "lessThan": "883b56ae58fe657d8497806c7059646e9ba6dbd0",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_gact.c",
            "net/sched/act_police.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.3",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.3",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.266",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.216",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.183",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.152",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.104",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.45",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.9",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-06T17:00:00.692905Z",
          "id": "CVE-2026-74620",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}