CVE-2026-74621

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2-rc6

Description An issue exists in the net/sched component where a memory leak occurs when header checks reject a packet. Specifically, the tcf ct handle fragments() function performs sanity checks using tcf ct ipv4 is fragment() or tcf ct ipv6 is fragment(). If these checks fail, they return an error without freeing or queuing the sk buff (socket buffer). However, the tcf ct act() function handles these errors by returning TC ACT CONSUMED, which signals to the caller that ownership of the sk buff has been transferred. Consequently, the caller does not free the buffer, leaving the sk buff and its associated data buffer orphaned in memory. This can lead to unbounded memory exhaustion when processing malformed packets.

Recommendations Update the Linux kernel to version 7.2-rc6 or later.