CVE-2026-74740

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking

rcu_access_pointer(a->goto_chain) and then calling

tcf_action_goto_chain_exec(), which does a second, independent

rcu_dereference_bh(a->goto_chain) read and immediately dereferences

chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact

replace path) can clear a->goto_chain between the two reads, so the second

read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.

Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain

in tcf_action_exec(), checking it once for NULL, and passing the resulting

chain pointer into tcf_action_goto_chain_exec(). This turns the split

check/use into a single check/use on one value.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References