CVE-2026-74620

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: act_gact, act_police: range check the fallback control action<br /> <br /> tcf_action_check_ctrlact() range checks the primary control action:<br /> <br /> if (!opcode)<br /> ret = action &gt; TC_ACT_VALUE_MAX ? -EINVAL : 0;<br /> <br /> TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it<br /> cannot be set that way. But act_gact and act_police each carry a second,<br /> independent control action supplied by user space that never reaches that<br /> helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject<br /> TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned<br /> verbatim from the action.<br /> <br /> In particular user space can store TC_ACT_CONSUMED, which is<br /> TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value<br /> range. That verdict tells every caller the action took ownership of the<br /> skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and<br /> tcf_qevent_handle() all deliberately skip the free for it. The result is<br /> one leaked sk_buff plus its data buffer per packet traversing the filter,<br /> unbounded, for all traffic on the chain including kernel-generated<br /> packets.<br /> <br /> Both are trivially deterministic. act_gact clamps tcfg_pval to &gt;= 1, so<br /> with pval = 1 gact_determ() returns the fallback for every packet.<br /> act_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and<br /> tcf_police_mtu_check() always passes.<br /> <br /> TC_ACT_CONSUMED was added by commit 720f22fed81b ("net: sched: refactor<br /> reinsert action"), after both goto-chain guards were written:<br /> commit 9469f375ab09 ("net/sched: act_gact: disallow &amp;#39;goto chain&amp;#39; on<br /> fallback control action") and<br /> commit c08f5ed5d625 ("net/sched: act_police: disallow &amp;#39;goto chain&amp;#39; on<br /> fallback control action"). Neither guard was widened when the new<br /> verdict appeared.<br /> <br /> Factor the existing range test out of tcf_action_check_ctrlact() as<br /> tcf_action_valid() and apply it to both fallbacks. The helper cannot call<br /> tcf_action_check_ctrlact() directly because that also allocates a<br /> goto_chain, which is exactly what these two sites must not do.<br /> <br /> Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte<br /> skbuff_head_cache object plus its 704-byte data buffer per packet. With<br /> this patch both configurations are rejected with -EINVAL and kmemleak<br /> reports none.