CVE-2026-74621

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

tcf_ct_handle_fragments() runs its header sanity checks before handing

anything to the defragmentation engine:

if (family == NFPROTO_IPV4)

err = tcf_ct_ipv4_is_fragment(skb, &frag);

else

err = tcf_ct_ipv6_is_fragment(skb, &frag);

if (err || !frag)

return err;

tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM;

tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of

them frees or queues the skb, so on that path the caller still owns it.

tcf_ct_act() however funnels every non-zero return into the

ownership-transfer exit:

err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);

if (err)

goto out_frag;

...

out_frag:

if (err != -EINPROGRESS)

tcf_action_inc_drop_qstats(&c->common);

return TC_ACT_CONSUMED;

TC_ACT_CONSUMED means the action took ownership of the skb, so no caller

frees it - sch_hand

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References