CVE-2026-74621

A flaw was found in the Linux kernel's net/sched: act_ct component. A remote attacker could exploit this vulnerability by sending specially crafted malformed packets. When these packets are rejected by header checks, the system fails to properly free the associated memory, leading to an unbounded memory leak. This continuous memory consumption can result in a Denial of Service (DoS), making the system unresponsive or unstable.

A resource leak in net sched act_ct can occur when malformed IPv4 or IPv6 fragment header checks reject a packet before the skb is handed to the conntrack defragmentation engine. The action then returned TC_ACT_CONSUMED even though it still owned the skb, so upper qdisc callers did not free it and one sk_buff plus its data buffer could be leaked per malformed packet. For the CVSS the PR:N value is used because an attacker only needs network reachability to an interface where tc action ct is configured and does not need a local account on the target. The issue is network reachable in deployments where clsact ingress or a similar tc path with action ct processes attacker controlled traffic. Impact is denial of service through unbounded kernel memory consumption. No confidentiality or integrity impact is assigned because the primitive is a resource leak rather than UAF, OOB access, information disclosure, or arbitrary write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.