CVE-2026-74740

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: act_api: fix TOCTOU NULL deref on a-&gt;goto_chain<br /> <br /> tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking<br /> rcu_access_pointer(a-&gt;goto_chain) and then calling<br /> tcf_action_goto_chain_exec(), which does a second, independent<br /> rcu_dereference_bh(a-&gt;goto_chain) read and immediately dereferences<br /> chain-&gt;filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact<br /> replace path) can clear a-&gt;goto_chain between the two reads, so the second<br /> read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.<br /> <br /> Fix the race by doing a single rcu_dereference_bh() read of a-&gt;goto_chain<br /> in tcf_action_exec(), checking it once for NULL, and passing the resulting<br /> chain pointer into tcf_action_goto_chain_exec(). This turns the split<br /> check/use into a single check/use on one value.