CVE-2026-74620

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_gact, act_police: range check the fallback control action

tcf_action_check_ctrlact() range checks the primary control action:

if (!opcode)

ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;

TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it

cannot be set that way. But act_gact and act_police each carry a second,

independent control action supplied by user space that never reaches that

helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject

TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned

verbatim from the action.

In particular user space can store TC_ACT_CONSUMED, which is

TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value

range. That verdict tells every caller the action took ownership of the

skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and

tcf_qevent_handle() all deliberately skip the free for it. The resu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References