The Linux kernel vulnerability CVE-2026-74621 involves a sk_buff memory leak in the net/sched act_ct module. The function tcf_ct_handle_fragments() performs header sanity checks on packets before defragmentation. When these checks fail (e.g., for malformed IPv4 or IPv6 fragments), the function returns errors without freeing the sk_buff. However, the caller tcf_ct_act() treats any non-zero return as if ownership of the sk_buff was transferred (TC_ACT_CONSUMED), causing the packet buffer to be orphaned and leaked. This results in one sk_buff plus its data buffer leaking per malformed packet, with no upper bound. The patch restores proper freeing of the sk_buff in error cases, preventing the leak. The issue was reproduced on Linux kernel v7.2-rc6 with specific malformed IPv6 packets, and fixed by ensuring the caller frees the sk_buff when appropriate.

The vulnerability causes a memory leak in the Linux kernel's network packet processing path. Each malformed packet that triggers the error path leaks kernel memory buffers (sk_buff and associated data), which could lead to resource exhaustion over time. The leak is unbounded and affects systems processing malformed packets with the affected kernel versions. There is no indication of direct code execution or privilege escalation from this issue.

A fix for this vulnerability has been committed to the Linux kernel source code. Users should update to a kernel version that includes this patch to prevent the sk_buff memory leak. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation. Patch status is not explicitly stated in the provided data; users should consult the Linux kernel vendor or distribution advisory for the exact fixed version and update accordingly.