CVE-2026-74620

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2-rc6

Description An issue exists in the network scheduler where the act gact and act police components fail to properly range check fallback control actions supplied by user space. Specifically, the TCA GACT PROB.paction and TCA POLICE RESULT variables only reject TC ACT GOTO CHAIN, allowing other values to be stored and returned verbatim. If a user provides TC ACT CONSUMED, which is outside the intended UAPI value range, the system incorrectly assumes the action took ownership of the skb (socket buffer). This causes the sch handle ingress(), sch handle egress(), and tcf qevent handle() functions to skip freeing the buffer, resulting in an unbounded leak of one sk buff and its associated data buffer for every packet traversing the filter.

Recommendations Update the Linux kernel to version 7.2-rc6 or later.