CVE-2026-74620

A flaw was found in the Linux kernel's net/sched subsystem, specifically within the act_gact and act_police modules. A local user could exploit this vulnerability by providing a specially crafted control action that bypasses proper range checks. This improper handling of control actions leads to an unbounded memory leak, where sk_buff objects and their data buffers are not freed. Consequently, this can result in a denial of service (DoS) for the system.

act_gact and act_police allowed user supplied fallback control actions outside the valid UAPI range. A local actor able to configure tc actions could store TC_ACT_CONSUMED as the fallback verdict, causing callers to believe the action took ownership of the skb and therefore skip freeing it. This leaks one sk_buff and its data buffer for each packet that traverses the affected filter, which can lead to unbounded kernel memory consumption and denial of service. For the CVSS the PR:L is used in the paranoid score because CAP_NET_ADMIN may be delegated to containers or service accounts, and such reduced capability control can still affect global kernel memory. The issue is not directly network reachable because the vulnerable state is created through local traffic control configuration, although network traffic can amplify the leak after the rule is installed. Impact is denial of service only, with no concrete UAF, OOB access, information leak, or privilege escalation primitive indicated by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.