Executive brief
The Linux kernel's network traffic control (act_ct) module fails to free network packets when header validation rejects them as malformed, causing memory to leak. An attacker can send crafted packets with invalid headers to trigger the leak repeatedly, exhausting system memory and potentially causing a denial of service that affects network connectivity and system stability.
Technical details
The vulnerability is a resource leak (sk_buff) in the Linux kernel's net/sched/act_ct module. The tcf_ct_handle_fragments() function performs header sanity checks on IPv4 and IPv6 packets before defragmentation, returning error codes like -EINVAL, -ENOMEM, or -EPROTO when headers are malformed. However, the caller tcf_ct_act() treats all non-zero returns uniformly by invoking an ownership-transfer exit path (TC_ACT_CONSUMED), which signals to the network stack that the skb was consumed and need not be freed by upper layers. For legitimate defragmentation cases (-EINPROGRESS), the defrag engine owns the skb; for error cases, the skb is leaked because it is neither freed locally nor passed back to the caller for cleanup. An attacker can send malformed packets (e.g., truncated IPv6 headers with nexthdr=0) to trigger the leak unbounded, exhausting memory. The fix distinguishes ownership states and frees the skb in the local error path.
Affected products
- Linux Linux kernel through v7.2-rc6 and likely earlier stable branches
Timeline
- 2026-08-22: disclosed