Executive brief
The Linux kernel's traffic control scheduler contains a validation gap in the act_gact and act_police modules that allows unprivileged code to inject invalid control actions. An attacker can exploit this to trigger unbounded memory leaks—one skbuffer and data buffer per packet—causing denial of service through exhaustion of available memory on systems using advanced traffic filtering.
Technical details
The vulnerability is a missing validation in the Linux kernel's traffic control (qdisc) subsystem. The act_gact and act_police modules accept fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) without range-checking them against kernel-internal verdict limits. An attacker can set these to TC_ACT_CONSUMED (value TC_ACT_VALUE_MAX + 1), a kernel-internal verdict that signals ownership of the sk_buff. When this verdict is returned, callers in sch_handle_ingress(), sch_handle_egress(), and tcf_qevent_handle() deliberately skip freeing the buffer, resulting in one memory leak per packet. The vulnerability is easily triggered: act_gact clamps pval to >= 1 so the fallback always activates; act_police with rate=0 also guarantees activation. The fix applies existing range-check logic (tcf_action_valid()) to both fallback actions to reject out-of-range verdicts.
Affected products
- Linux Linux Kernel 7.2-rc6 and earlier (vulnerability present since commit 720f22fed81b)
Timeline
- 2026-08-22: disclosed