Answer in brief
CVE-2026-74621 records a Unknown severity vulnerability in net/sched: act_ct: fix sk_buff leak when the header checks reject a packet. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=73f7da5fd124f2cda9161e2e46114915e6e82e97 <737873a59905a54ca0d2d127ef882f3f88bf4379 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <47d99828591d0fe8be4b9c8992ff3b8e47968db9 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <b47bb899e04b5407c5a63fe88d4b6676586a6e84 || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <439d3e404f9d5e515911cc8132cde198b337c19e || >=3f14b377d01d8357eba032b4cabc8c1149b458b6 <8a7ed561671aa6a911a2de99e59ef670a4d0b1df || 172ba7d46c202e679f3ccb10264c67416aaeb1c4 || 0b5b831122fc3789fff75be433ba3e4dd7b779d4 || f5346df0591d10bc948761ca854b1fae6d2ef441 || >=6.6.14 <6.6.152 || >=5.15.148 <5.16 || >=6.1.75 <6.2 || >=6.7.2 <6.8 | 737873a59905a54ca0d2d127ef882f3f88bf4379, 47d99828591d0fe8be4b9c8992ff3b8e47968db9, b47bb899e04b5407c5a63fe88d4b6676586a6e84, 439d3e404f9d5e515911cc8132cde198b337c19e, 8a7ed561671aa6a911a2de99e59ef670a4d0b1df, 6.6.152, 5.16, 6.2, 6.8 |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine: if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(skb, &frag); else err = tcf_ct_ipv6_is_fragment(skb, &frag); if (err || !frag) return err; tcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM; tcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of them frees or queues the skb, so on that path the caller still owns it. tcf_ct_act() however funnels every non-zero return into the ownership-transfer exit: err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); if (err) goto out_frag; ... out_frag: if (err != -EINPROGRESS) tcf_action_inc_drop_qstats(&c->common); return TC_ACT_CONSUMED; TC_ACT_CONSUMED means the action took ownership of the skb, so no caller frees it - sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for that verdict. The skb is therefore orphaned: one sk_buff plus its data buffer is leaked per malformed packet, unbounded. Note the drop counter is already incremented for these errors, so the statistics claim a drop that never happens. Three different ownership states reach out_frag: today - the skb may be queued by the defrag engine (-EINPROGRESS), already freed by nf_ct_handle_fragments(), or still owned by us. Tell the caller which of those it is, and free the packet ourselves in the last case, which restores the TC_ACT_SHOT behaviour that predated the Fixes: commit. Reproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6 header with nexthdr = 0 (hop-by-hop) and nothing after it, on a clsact ingress chain with "action ct". kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet; with this patch it reports none.
Quoted source text, attributed separately from HOL analysis.