CVE-2026-74740

In the Linux kernel, the following vulnerability has been resolved:

net/sched: actapi: fix TOCTOU NULL deref on a->gotochain

tcfactionexec() handles TCACTGOTOCHAIN by first checking rcuaccesspointer(a->gotochain) and then calling tcfactiongotochainexec(), which does a second, independent rcudereferencebh(a->gotochain) read and immediately dereferences chain->filterchain. A concurrent tcfactionsetctrlact() (e.g. the gact replace path) can clear a->gotochain between the two reads, so the second read returns NULL and tcfactiongotochainexec() dereferences NULL.

Fix the race by doing a single rcudereferencebh() read of a->gotochain in tcfactionexec(), checking it once for NULL, and passing the resulting chain pointer into tcfactiongotochain_exec(). This turns the split check/use into a single check/use on one value.