CVE-2026-74740 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking rcu_access_pointer(a->goto_chain) and then calling tcf_action_goto_chain_exec(), which does a second, independent rcu_dereference_bh(a->goto_chain) read and immediately dereferences chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact replace path) can clear a->goto_chain between the two reads, so the second read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.
Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain in tcf_action_exec(), checking it once for NULL, and passing the resulting chain pointer into tcf_action_goto_chain_exec(). This turns the split check/use into a single check/use on one value.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel networking subsystem contains a time-of-check to time-of-use vulnerability within the traffic control action API implementation. Specifically, in the net/sched/act_api.c module, the function tcf_action_exec() processes actions that require jumping to another chain of filters via the TC_ACT_GOTO_CHAIN operation. The original code structure performs an initial check using rcu_access_pointer on the a->goto_chain pointer to verify its validity before proceeding with execution. However, this is followed by a separate call to tcf_action_goto_chain_exec(), which independently retrieves the same goto_chain pointer using rcu_dereference_bh and immediately dereferences it without re-verifying that the value remains consistent or non-null. This separation of check and use creates a window where concurrent modifications can invalidate the initial assumption, leading to a null pointer dereference.
The core technical flaw lies in the lack of atomicity between checking for NULL and using the retrieved pointer within an RCU-protected context. While rcu_access_pointer provides a lockless read that is safe against memory reclamation if used correctly, it does not prevent other threads from modifying the underlying data structure concurrently. In this scenario, a concurrent call to tcf_action_set_ctrlact(), such as when replacing or deleting a generic action via gact, can clear the a->goto_chain field between the initial check in tcf_action_exec() and the subsequent dereference inside tcf_action_goto_chain_exec(). Because these two operations are not synchronized by holding a reference count or using a single unified read-modify-write sequence, the second operation may observe a NULL value that was set during the gap. Dereferencing this NULL pointer results in a kernel panic, causing a denial of service for the affected system.
From an industry standards perspective, this vulnerability is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. The flaw represents a classic race condition where the state of the resource changes between verification and utilization. In terms of MITRE ATT&CK mapping, this aligns with techniques involving exploitation of software logic errors rather than memory corruption vulnerabilities like buffer overflows. Although it does not directly lead to arbitrary code execution in its current form due to the nature of NULL dereferences typically causing crashes, it significantly impacts system availability and stability. The vulnerability highlights the complexity of maintaining consistency in lockless RCU data structures when multiple accessors interact with shared state without proper synchronization primitives or reference counting mechanisms.
The operational impact of this vulnerability is primarily a denial of service condition. An attacker who can trigger traffic control actions that involve chain jumps, combined with concurrent modifications to those action configurations, could induce kernel oopses or panics. This disrupts network processing capabilities and may require system reboots to restore functionality. In environments where high availability is critical, such as production servers handling significant network throughput, repeated exploitation attempts could lead to sustained service degradation. The vulnerability affects systems running Linux kernels prior to the application of this specific patch in net/sched/act_api.c.
Mitigation strategies involve applying the upstream kernel fix which consolidates the RCU read operations into a single atomic step. By performing one rcu_dereference_bh() call on a->goto_chain, checking it for NULL once, and passing that validated pointer directly to tcf_action_goto_chain_exec(), the race window is eliminated. System administrators should ensure their kernels are updated with this patch. Additionally, reducing exposure involves limiting untrusted access to traffic control configuration interfaces such as tc commands or netlink sockets used by container runtimes and orchestration tools like Kubernetes. Implementing strict RBAC policies for network namespace manipulation can further reduce the attack surface available to potential adversaries seeking to trigger these race conditions through rapid concurrent modifications of action chains.