CVE-2026-74740 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux-based systems, especially those relying on act_api, should assess their exposure and prioritize patching or applying compensating controls.

Why it matters

CVE-2026-74740 is a TOCTOU vulnerability in the Linux kernel's act_api that can lead to NULL dereferences. Linux kernel maintainers and users should assess exposure, prioritize patching, and consider compensating controls.

• Verification of patch deployment is necessary to prevent potential NULL dereferences.
• Exposure assessment is required for Linux kernel deployments using act_api.
• Compensating controls and monitoring may be necessary until remediation is confirmed.

Technical summary

The TOCTOU vulnerability in act_api allows for a NULL dereference on a->goto_chain due to a race condition. The fix involves performing a single rcu_dereference_bh() read and check for NULL before passing the chain pointer to tcf_action_goto_chain_exec(). Linux kernel maintainers and users should assess exposure and verify patches, prioritizing updates for systems relying on act_api. Compensating controls, monitoring, and exception tracking may be necessary until remediation is confirmed. The vulnerability arises from a race condition in the tcf_action_exec() function, which handles TC_ACT_GOTO_CHAIN. This condition allows for a NULL dereference on a->goto_chain.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patches, prioritizing updates for systems relying on act_api. Compensating controls, monitoring, and exception tracking may be necessary until remediation is confirmed.

Recommended defensive actions

• Assess exposure of Linux kernel deployments to CVE-2026-74740
• Verify and apply patches or updates for act_api
• Implement compensating controls and monitoring for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Multiple source references from the Linux kernel Git repository are available, detailing the patches and fixes applied to address the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.