CVE-2026-74740: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
In the Linux kernel, the following vulnerability has been resolved:
net/sched: actapi: fix TOCTOU NULL deref on a->gotochain
tcfactionexec() handles TCACTGOTOCHAIN by first checking rcuaccesspointer(a->gotochain) and then calling tcfactiongotochainexec(), which does a second, independent rcudereferencebh(a->gotochain) read and immediately dereferences chain->filterchain. A concurrent tcfactionsetctrlact() (e.g. the gact replace path) can clear a->gotochain between the two reads, so the second read returns NULL and tcfactiongotochainexec() dereferences NULL.
Fix the race by doing a single rcudereferencebh() read of a->gotochain in tcfactionexec(), checking it once for NULL, and passing the resulting chain pointer into tcfactiongotochainexec(). This turns the split check/use into a single check/use on one value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.105-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.107-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.153 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.105 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.46 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Fix tcf_action_exec() to perform a single rcu_dereference_bh(a->goto_chain) read, check the resulting chain pointer once for NULL, and pass that same pointer to tcf_action_goto_chain_exec() instead of rereading a->goto_chain.
Event History
Frequently Asked Questions
Which systems are exposed to this race?
Linux kernel systems using traffic-control actions that take the TC_ACT_GOTO_CHAIN path are relevant. The race requires a concurrent control-action update that clears the action’s goto_chain pointer, such as a gact replace operation.
What concurrent activity is needed to trigger the issue?
One execution path must check and use the goto-chain action while another path calls tcf_action_set_ctrlact() and clears goto_chain between those operations. The vulnerable sequence occurs because the pointer was read separately for the initial check and later use.
What does the fix change?
The fix reads goto_chain once with rcu_dereference_bh(), verifies that single value is non-NULL, and passes that same pointer to the goto-chain execution function. This prevents a concurrent update from changing the pointer between the check and dereference.