kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

The vulnerability of the tcf_ct_flow_table_get() function in the net/sched/act_ct.c module of the net/sched/traffic-management subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcfctflowtableget function in the net/sched/actct.c module of the net/sched/traffic management subsystem of the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

The vulnerability of the tcf_ct_skb_nfct_cached() function in the net/sched/act_ct.c module of the network scheduling subsystem of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the tcfctskbnfctcached function in the net/sched/actct.c module of the net/sched subsystem of the Linux operating system’s kernel is related to insufficient protection of service data. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2026-72057

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

SUSE CVE-2026-72430

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix nfconnlabels leak on two error paths tcfctfillparams calls nfconnlabelsget setting putlabels when TCACTLABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err:...

The vulnerability of the tcf_ct_init() function in the net/sched/act_ct.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcfctinit function in the net/sched/actct.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2026-74621

A flaw was found in the Linux kernel's net/sched: actct component. A remote attacker could exploit this vulnerability by sending specially crafted malformed packets. When these packets are rejected by header checks, the system fails to properly free the associated memory, leading to an unbounded...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actct: Preserve tcskbcb during defragmentation. tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defragmentation helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actct: Fixed the leak in nfconnlabels on two error paths. The function tcfctfillparams calls nfconnlabelsget to set putlabels, when TCACTLABELS is present. However, two subsequent error paths use a bare return inste...

SUSE CVE-2026-74621

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

AZL-97080 CVE-2026-74621 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-74621

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-74621

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

UBUNTU-CVE-2026-74621

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

EUVD-2026-64558

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-74621 net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-74621

CVE-2026-74621 is an unbounded memory leak in the Linux kernel's net/sched: act_ct (traffic control connection-tracking action). When tcf_ct_handle_fragments() rejects a packet via header sanity checks (returning -EINVAL, -ENOMEM, or -EPROTO), the skb remains owned by the caller, yet tcf_ct_act()...

CVE-2026-74621 net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

Linux Distros Unpatched Vulnerability : CVE-2026-74621

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the...