CVE-2026-74740: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
In the Linux kernel, the following vulnerability has been resolved:
net/sched: actapi: fix TOCTOU NULL deref on a->gotochain
tcfactionexec() handles TCACTGOTOCHAIN by first checking rcuaccesspointer(a->gotochain) and then calling tcfactiongotochainexec(), which does a second, independent rcudereferencebh(a->gotochain) read and immediately dereferences chain->filterchain. A concurrent tcfactionsetctrlact() (e.g. the gact replace path) can clear a->gotochain between the two reads, so the second read returns NULL and tcfactiongotochainexec() dereferences NULL.
Fix the race by doing a single rcudereferencebh() read of a->gotochain in tcfactionexec(), checking it once for NULL, and passing the resulting chain pointer into tcfactiongotochainexec(). This turns the split check/use into a single check/use on one value.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race?
Linux kernel systems using traffic-control actions that take the TC_ACT_GOTO_CHAIN path are relevant. The race requires a concurrent control-action update that clears the action’s goto_chain pointer, such as a gact replace operation.
What concurrent activity is needed to trigger the issue?
One execution path must check and use the goto-chain action while another path calls tcf_action_set_ctrlact() and clears goto_chain between those operations. The vulnerable sequence occurs because the pointer was read separately for the initial check and later use.
What does the fix change?
The fix reads goto_chain once with rcu_dereference_bh(), verifies that single value is non-NULL, and passes that same pointer to the goto-chain execution function. This prevents a concurrent update from changing the pointer between the check and dereference.