The Linux kernel vulnerability CVE-2026-74620 affects the net/sched subsystem, specifically the act_gact and act_police modules. The function tcf_action_check_ctrlact() properly range-checks the primary control action but does not validate the secondary fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) against the full range of valid verdicts. This allows user space to set the fallback action to TC_ACT_CONSUMED, a verdict outside the official UAPI range. TC_ACT_CONSUMED signals that the packet buffer (skb) is consumed and should not be freed, causing a memory leak of one sk_buff plus its data buffer per packet. The leak is unbounded and affects all traffic on the chain, including kernel-generated packets. The vulnerability was introduced after TC_ACT_CONSUMED was added but the existing range checks were not updated to include it. The fix involves factoring out the range test into a helper function and applying it to both primary and fallback control actions, rejecting invalid values with -EINVAL. Testing on version 7.2-rc6 confirmed the leak and its resolution.

This vulnerability causes an unbounded memory leak in the Linux kernel's network scheduler for all packets processed by the affected filters. Each packet leaks one sk_buff structure and its associated data buffer, which can lead to resource exhaustion over time. The leak affects both user and kernel-generated packets on the chain. There is no indication of direct code execution or privilege escalation from the provided data.

A fix is available that properly validates fallback control actions and rejects invalid values, preventing the memory leak. Users should apply the official kernel patch that includes this validation. Since no vendor advisory or patch link is provided here, check the Linux kernel mailing lists or official kernel repositories for the patch corresponding to CVE-2026-74620. Until patched, avoid configurations that set fallback control actions to values outside the official range.