CVE-2026-74621 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine:
if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(skb, &frag); else err = tcf_ct_ipv6_is_fragment(skb, &frag); if (err || !frag) return err;
tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM; tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of them frees or queues the skb, so on that path the caller still owns it.
tcf_ct_act() however funnels every non-zero return into the ownership-transfer exit:
err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); if (err) goto out_frag; ... out_frag: if (err != -EINPROGRESS) tcf_action_inc_drop_qstats(&c->common); return TC_ACT_CONSUMED;
TC_ACT_CONSUMED means the action took ownership of the skb, so no caller frees it - sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for that verdict. The skb is therefore orphaned: one sk_buff plus its data buffer is leaked per malformed packet, unbounded. Note the drop counter is already incremented for these errors, so the statistics claim a drop that never happens.
Three different ownership states reach out_frag: today - the skb may be queued by the defrag engine (-EINPROGRESS), already freed by nf_ct_handle_fragments(), or still owned by us. Tell the caller which of those it is, and free the packet ourselves in the last case, which restores the TC_ACT_SHOT behaviour that predated the Fixes: commit.
Reproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6 header with nexthdr = 0 (hop-by-hop) and nothing after it, on a clsact ingress chain with "action ct". kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet; with this patch it reports none.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel networking subsystem contains a memory leak vulnerability within the connection tracking action implementation, specifically in the net/sched/act_ct module. This flaw arises from an incorrect handling of socket buffer ownership during fragment processing and header validation. When packets are processed through the clsact ingress or egress chains with connection tracking actions enabled, the system performs sanity checks on packet headers before attempting to defragment them. If these checks fail due malformed input such as invalid IPv6 extension headers or unexpected protocol types, the function returns an error code without releasing the associated sk_buff structure. This oversight creates a situation where the kernel retains ownership of memory that should have been freed, leading to unbounded resource exhaustion under sustained attack conditions.
The technical root cause lies in the interaction between tcf_ct_handle_fragments and its caller functions like tcf_ct_act. The fragment handling routine performs header validation using helper functions such as tcf_ct_ipv4_is_fragment or tcf_ct_ipv6_is_fragment. These helpers return error codes including -EINVAL, -ENOMEM, or -EPROTO when they detect anomalies in the packet structure. Crucially, these functions do not free the socket buffer upon failure because they assume the caller will manage cleanup based on the returned status. However, the calling function tcf_ct_act incorrectly interprets any non-zero return value as a signal to transfer ownership of the sk_buff back to the network stack via TC_ACT_CONSUMED. This verdict instructs subsequent handlers like sch_handle_ingress or sch_handle_egress that they must not free the buffer because it is already consumed by the action module. Consequently, when an error occurs during header validation, the buffer is neither freed internally nor passed for external cleanup, resulting in a direct memory leak.
The operational impact of this vulnerability is significant due to its potential for denial of service through resource exhaustion. Each malformed packet that triggers the flawed code path results in the leakage of one sk_buff_head_cache object along with its associated data buffer. In typical scenarios involving IPv6 packets with invalid extension headers, such as a 54-byte frame carrying a 40-byte header with an unexpected nexthdr value, kmemleak reports the loss of approximately nine hundred bytes per packet. Under high-volume traffic conditions where attackers send numerous malformed fragments or packets with corrupted headers, this unbounded leak can rapidly deplete kernel memory pools. This leads to system instability, network performance degradation, and potentially a complete crash if critical memory allocations fail. The vulnerability effectively allows remote adversaries to trigger local resource exhaustion without requiring authentication or privileged access, provided they can inject traffic into the affected interface chains.
From a classification perspective, this issue aligns with CWE-401 which describes missing release of memory after effective usage. It also relates to CWE-789 concerning memory allocation race conditions although here it is more accurately described as improper resource management due to logic errors in control flow rather than true concurrency issues. In the context of MITRE ATT&CK, this vulnerability supports techniques associated with Resource Hijacking and Denial of Service, specifically leveraging local or remote input validation failures to exhaust system resources. The flaw persists because the error handling path fails to distinguish between cases where the defragmentation engine has taken ownership of the buffer versus cases where no processing occurred due to early rejection.
To mitigate this vulnerability, developers must modify the error handling logic in tcf_ct_act to correctly manage socket buffer lifecycles based on the specific return value received from fragment handling routines. When an error such as -EINVAL or -EPROTO is returned indicating that header checks failed and no defragmentation occurred, the action module should explicitly free the sk_buff using kfree_skb before returning a verdict like TC_ACT_SHOT rather than TC_ACT_CONSUMED. This ensures that ownership remains with the caller who will properly release the resource. Additionally, system administrators can apply kernel patches or updates provided by their distribution vendors to resolve this issue in production environments. Monitoring for unusual spikes in memory usage associated with network interfaces and validating packet integrity at ingress points using firewall rules can also help reduce exposure until permanent fixes are deployed.