GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74620 (GCVE-0-2026-74620)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-23 12:47
VLAI
Title
net/sched: act_gact, act_police: range check the fallback control action
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0; TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it cannot be set that way. But act_gact and act_police each carry a second, independent control action supplied by user space that never reaches that helper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject TC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned verbatim from the action. In particular user space can store TC_ACT_CONSUMED, which is TC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value range. That verdict tells every caller the action took ownership of the skb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and tcf_qevent_handle() all deliberately skip the free for it. The result is one leaked sk_buff plus its data buffer per packet traversing the filter, unbounded, for all traffic on the chain including kernel-generated packets. Both are trivially deterministic. act_gact clamps tcfg_pval to >= 1, so with pval = 1 gact_determ() returns the fallback for every packet. act_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and tcf_police_mtu_check() always passes. TC_ACT_CONSUMED was added by commit 720f22fed81b ("net: sched: refactor reinsert action"), after both goto-chain guards were written: commit 9469f375ab09 ("net/sched: act_gact: disallow 'goto chain' on fallback control action") and commit c08f5ed5d625 ("net/sched: act_police: disallow 'goto chain' on fallback control action"). Neither guard was widened when the new verdict appeared. Factor the existing range test out of tcf_action_check_ctrlact() as tcf_action_valid() and apply it to both fallbacks. The helper cannot call tcf_action_check_ctrlact() directly because that also allocates a goto_chain, which is exactly what these two sites must not do. Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte skbuff_head_cache object plus its 704-byte data buffer per packet. With this patch both configurations are rejected with -EINVAL and kmemleak reports none.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 5f038affdacaffedf6a85a06cf59ec0a852d36a7 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 725efc2ab4a40affc4e285a2dc4896d103948a6c (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 6bcb8839aa2d686964a4154650afc4db91e1c514 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 5344e01179baa37547ab29fd7b8614f83faa190c (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 92f00f1d4d204a428b38e26fce3baee144b6955d (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 2e8df8c9190335475a3b64a159d3efd8cdd1cb73 (git)
Affected: 720f22fed81bc6fd1765db7014651b6718887bea , < 883b56ae58fe657d8497806c7059646e9ba6dbd0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.10.266 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_gact.c",
            "net/sched/act_police.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f038affdacaffedf6a85a06cf59ec0a852d36a7",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "725efc2ab4a40affc4e285a2dc4896d103948a6c",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "6bcb8839aa2d686964a4154650afc4db91e1c514",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "5344e01179baa37547ab29fd7b8614f83faa190c",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "92f00f1d4d204a428b38e26fce3baee144b6955d",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "2e8df8c9190335475a3b64a159d3efd8cdd1cb73",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            },
            {
              "lessThan": "883b56ae58fe657d8497806c7059646e9ba6dbd0",
              "status": "affected",
              "version": "720f22fed81bc6fd1765db7014651b6718887bea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_gact.c",
            "net/sched/act_police.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_gact, act_police: range check the fallback control action\n\ntcf_action_check_ctrlact() range checks the primary control action:\n\n\tif (!opcode)\n\t\tret = action \u003e TC_ACT_VALUE_MAX ? -EINVAL : 0;\n\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\ncannot be set that way. But act_gact and act_police each carry a second,\nindependent control action supplied by user space that never reaches that\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\nverbatim from the action.\n\nIn particular user space can store TC_ACT_CONSUMED, which is\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\nrange. That verdict tells every caller the action took ownership of the\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for it. The result is\none leaked sk_buff plus its data buffer per packet traversing the filter,\nunbounded, for all traffic on the chain including kernel-generated\npackets.\n\nBoth are trivially deterministic. act_gact clamps tcfg_pval to \u003e= 1, so\nwith pval = 1 gact_determ() returns the fallback for every packet.\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\ntcf_police_mtu_check() always passes.\n\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\"net: sched: refactor\nreinsert action\"), after both goto-chain guards were written:\ncommit 9469f375ab09 (\"net/sched: act_gact: disallow \u0027goto chain\u0027 on\nfallback control action\") and\ncommit c08f5ed5d625 (\"net/sched: act_police: disallow \u0027goto chain\u0027 on\nfallback control action\"). Neither guard was widened when the new\nverdict appeared.\n\nFactor the existing range test out of tcf_action_check_ctrlact() as\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\ntcf_action_check_ctrlact() directly because that also allocates a\ngoto_chain, which is exactly what these two sites must not do.\n\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\nthis patch both configurations are rejected with -EINVAL and kmemleak\nreports none."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:46.379Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4"
        },
        {
          "url": "https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514"
        },
        {
          "url": "https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c"
        },
        {
          "url": "https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73"
        },
        {
          "url": "https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0"
        }
      ],
      "title": "net/sched: act_gact, act_police: range check the fallback control action",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74620",
    "datePublished": "2026-08-22T15:32:04.254Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-08-23T12:47:46.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74620",
      "date": "2026-09-17",
      "epss": "0.00177",
      "percentile": "0.07485"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:48:16.000Z",
      "cve": "CVE-2026-74620",
      "id": "msrc_CVE-2026-74620",
      "initial_release_date": "2026-08-24T01:04:58.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: act_gact, act_police: range check the fallback control action",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74620.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74620\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:34.753\",\"lastModified\":\"2026-08-23T13:16:47.047\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: act_gact, act_police: range check the fallback control action\\n\\ntcf_action_check_ctrlact() range checks the primary control action:\\n\\n\\tif (!opcode)\\n\\t\\tret = action \u003e TC_ACT_VALUE_MAX ? -EINVAL : 0;\\n\\nTC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-internal verdicts above it\\ncannot be set that way. But act_gact and act_police each carry a second,\\nindependent control action supplied by user space that never reaches that\\nhelper - TCA_GACT_PROB.paction and TCA_POLICE_RESULT. Both only reject\\nTC_ACT_GOTO_CHAIN, so any other value is stored verbatim and returned\\nverbatim from the action.\\n\\nIn particular user space can store TC_ACT_CONSUMED, which is\\nTC_ACT_VALUE_MAX + 1 and is deliberately not part of the UAPI value\\nrange. That verdict tells every caller the action took ownership of the\\nskb, so nobody frees it: sch_handle_ingress(), sch_handle_egress() and\\ntcf_qevent_handle() all deliberately skip the free for it. The result is\\none leaked sk_buff plus its data buffer per packet traversing the filter,\\nunbounded, for all traffic on the chain including kernel-generated\\npackets.\\n\\nBoth are trivially deterministic. act_gact clamps tcfg_pval to \u003e= 1, so\\nwith pval = 1 gact_determ() returns the fallback for every packet.\\nact_police has no mandatory rate, so rate = 0 leaves tcfp_mtu = ~0 and\\ntcf_police_mtu_check() always passes.\\n\\nTC_ACT_CONSUMED was added by commit 720f22fed81b (\\\"net: sched: refactor\\nreinsert action\\\"), after both goto-chain guards were written:\\ncommit 9469f375ab09 (\\\"net/sched: act_gact: disallow \u0027goto chain\u0027 on\\nfallback control action\\\") and\\ncommit c08f5ed5d625 (\\\"net/sched: act_police: disallow \u0027goto chain\u0027 on\\nfallback control action\\\"). Neither guard was widened when the new\\nverdict appeared.\\n\\nFactor the existing range test out of tcf_action_check_ctrlact() as\\ntcf_action_valid() and apply it to both fallbacks. The helper cannot call\\ntcf_action_check_ctrlact() directly because that also allocates a\\ngoto_chain, which is exactly what these two sites must not do.\\n\\nReproduced on v7.2-rc6: kmemleak reports one leaked 232-byte\\nskbuff_head_cache object plus its 704-byte data buffer per packet. With\\nthis patch both configurations are rejected with -EINVAL and kmemleak\\nreports none.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/act_api.h\",\"net/sched/act_gact.c\",\"net/sched/act_police.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"5f038affdacaffedf6a85a06cf59ec0a852d36a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"725efc2ab4a40affc4e285a2dc4896d103948a6c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"6bcb8839aa2d686964a4154650afc4db91e1c514\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"5344e01179baa37547ab29fd7b8614f83faa190c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"92f00f1d4d204a428b38e26fce3baee144b6955d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"2e8df8c9190335475a3b64a159d3efd8cdd1cb73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"720f22fed81bc6fd1765db7014651b6718887bea\",\"lessThan\":\"883b56ae58fe657d8497806c7059646e9ba6dbd0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/act_api.h\",\"net/sched/act_gact.c\",\"net/sched/act_police.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.266\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e8df8c9190335475a3b64a159d3efd8cdd1cb73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5344e01179baa37547ab29fd7b8614f83faa190c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f038affdacaffedf6a85a06cf59ec0a852d36a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bcb8839aa2d686964a4154650afc4db91e1c514\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/725efc2ab4a40affc4e285a2dc4896d103948a6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/883b56ae58fe657d8497806c7059646e9ba6dbd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/92f00f1d4d204a428b38e26fce3baee144b6955d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/efa58aeb6a99028b1fbc3ab2f31ba3a881211ad4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-24T14:48:29+00:00",
      "cve": "CVE-2026-74620",
      "id": "CVE-2026-74620",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: act_gact, act_police: range check the fallback control action",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74620.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:17:40Z",
      "cve": "CVE-2026-74620",
      "id": "CVE-2026-74620",
      "initial_release_date": "2026-08-23T00:05:49Z",
      "product_status:known_affected": "318",
      "product_status:known_not_affected": "39",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74620",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74620.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.