CVE-2026-74621 Linux CVE debrief

Who should care

Linux kernel administrators and developers should be aware of this vulnerability and take steps to patch vulnerable versions. Defenders should prioritize patching vulnerable Linux kernel versions to prevent potential memory leaks and denial-of-service attacks. System administrators and security teams responsible for Linux kernel-based systems should review and update Linux kernel versions to ensure they are not vulnerable to this issue.

Why it matters

CVE-2026-74621 is a vulnerability in the Linux kernel's net/sched: act_ct module that can cause a sk_buff leak when header checks reject a packet. Defenders should prioritize patching vulnerable Linux kernel versions to prevent potential memory leaks and denial-of-service attacks.

• Memory leak due to improper handling of packet fragments.
• Potential denial-of-service attack.
• Need to patch vulnerable Linux kernel versions.
• Verify Linux kernel versions to ensure they are not vulnerable.

Technical summary

The vulnerability is caused by the improper handling of packet fragments in the tcf_ct_handle_fragments() function. When the header checks fail, the function returns an error without freeing the sk_buff, leading to a memory leak. This issue can potentially lead to a denial-of-service attack. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Defenders should prioritize patching vulnerable Linux kernel versions to prevent potential memory leaks and denial-of-service attacks. The issue arises from the improper handling of packet fragments in the net/sched: act_ct module.

Defensive priority

Defenders should prioritize patching vulnerable Linux kernel versions to prevent potential memory leaks and denial-of-service attacks.

Recommended defensive actions

• Patch vulnerable Linux kernel versions to prevent potential memory leaks and denial-of-service attacks.
• Review and update Linux kernel versions to ensure they are not vulnerable to this issue.
• Monitor system logs for potential denial-of-service attacks.
• Verify Linux kernel versions to ensure they are not vulnerable.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the improper handling of packet fragments in the tcf_ct_handle_fragments() function. When the header checks fail, the function returns an error without freeing the sk_buff, leading to a memory leak.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.