Executive brief
The Linux kernel's traffic control (TC) action scheduler has a race condition in how it handles action chain execution. When multiple threads try to modify and execute traffic control rules concurrently, one thread can clear a chain pointer between two separate checks, causing the second operation to crash due to a NULL pointer dereference. This can lead to kernel panics and system instability for systems using advanced traffic control policies.
Technical details
A time-of-check-time-of-use (TOCTOU) race condition exists in net/sched/act_api.c in the tcf_action_exec() function. The code performs an initial rcu_access_pointer() check on a->goto_chain, then calls tcf_action_goto_chain_exec() which performs a second independent rcu_dereference_bh() read. Between these two reads, a concurrent tcf_action_set_ctrlact() call (e.g., from gact replace path) can clear a->goto_chain, causing the second read to return NULL. The function then immediately dereferences this NULL pointer when accessing chain->filter_chain. The fix consolidates the check and use into a single rcu_dereference_bh() operation in tcf_action_exec(), passing the validated pointer to tcf_action_goto_chain_exec(). This eliminates the window for concurrent modification. The patch was committed in August 2026 and backported to multiple kernel stable series.
Affected products
- Linux Linux kernel multiple versions prior to fix (August 2026)
Timeline
- 2026-08-26: disclosed: CVE-2026-74740 published
- 2026-08-23: patched: Fix committed to stable kernel tree by Greg Kroah-Hartman