CVE-2026-74740
Received Received - Intake

Race Condition in Linux Kernel's TC Action API

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking rcu_access_pointer(a->goto_chain) and then calling tcf_action_goto_chain_exec(), which does a second, independent rcu_dereference_bh(a->goto_chain) read and immediately dereferences chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact replace path) can clear a->goto_chain between the two reads, so the second read returns NULL and tcf_action_goto_chain_exec() dereferences NULL. Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain in tcf_action_exec(), checking it once for NULL, and passing the resulting chain pointer into tcf_action_goto_chain_exec(). This turns the split check/use into a single check/use on one value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74740
EUVD
EUVD-2026-66570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's traffic control action subsystem. It occurs when tcf_action_exec() checks and then uses a pointer to a goto_chain without proper synchronization. A concurrent operation can clear the pointer between the check and use, leading to a NULL pointer dereference and potential kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's traffic control (TC) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using tools like 'dmesg' or 'journalctl' to look for NULL pointer dereference messages in the TC subsystem. No direct network commands detect this, but monitoring kernel logs for crashes or warnings in the TC module may indicate exploitation.

Impact Analysis

If exploited, this vulnerability could cause a kernel panic or system crash, leading to denial of service. It requires local access and specific conditions to trigger, so remote exploitation is unlikely. Users might experience system instability or unexpected reboots.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that includes the fix for CVE-2026-74740. Check your distribution's security advisories for kernel updates. If updating is not immediately possible, consider disabling or restricting access to the TC subsystem via kernel module blacklisting or firewall rules until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart