{"id":"CVE-2026-72430","state":"PUBLISHED","title":"net/sched: act_ct: fix nf_connlabels leak on two error paths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix nf_connlabels leak on two error paths\n\ntcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when\nTCA_CT_LABELS is present, but two later error sites use a bare return\ninstead of \"goto err\", skipping the err: nf_connlabels_put() cleanup.\nThey also precede the \"p->put_labels = put_labels\" assignment, so the\ntcf_ct_params_free() fallback does not release the count either. Each\nfailed RTM_NEWACTION on these paths leaks one nf_connlabels reference:\nnet->ct.labels_used is incremented and never released. The action is\nreachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged\nuser namespace on default-userns kernels.\n\nImpact: an unprivileged user with CAP_NET_ADMIN over a network namespace\n(e.g. via user namespaces) leaks one nf_connlabels reference per failed\nRTM_NEWACTION on the two error paths; net->ct.labels_used is never\nreleased.\n\nThe err: label is safe to reach from both sites: p->tmpl is still NULL\nthere (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so\nno inline release is needed.","publishedAt":"2026-08-15T05:56:46.178Z","updatedAt":"2026-08-17T05:14:29.962Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"13b561c893c741635adce3781490a7a1099106c8","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"1d51aff78f078af1a80e9496c2f4643f4c0ef0a0","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"16e088016f38cf728a0de709c3335cc5a3850476","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/act_ct.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.7","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/act_ct.c"]}],"references":["https://git.kernel.org/stable/c/13b561c893c741635adce3781490a7a1099106c8","https://git.kernel.org/stable/c/1d51aff78f078af1a80e9496c2f4643f4c0ef0a0","https://git.kernel.org/stable/c/0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4","https://git.kernel.org/stable/c/16e088016f38cf728a0de709c3335cc5a3850476"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72430.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72430","state":"PUBLISHED","datePublished":"2026-08-15T05:56:46.178Z","dateUpdated":"2026-08-17T05:14:29.962Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.928Z"},"containers":{"cna":{"title":"net/sched: act_ct: fix nf_connlabels leak on two error paths","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix nf_connlabels leak on two error paths\n\ntcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when\nTCA_CT_LABELS is present, but two later error sites use a bare return\ninstead of \"goto err\", skipping the err: nf_connlabels_put() cleanup.\nThey also precede the \"p->put_labels = put_labels\" assignment, so the\ntcf_ct_params_free() fallback does not release the count either. Each\nfailed RTM_NEWACTION on these paths leaks one nf_connlabels reference:\nnet->ct.labels_used is incremented and never released. The action is\nreachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged\nuser namespace on default-userns kernels.\n\nImpact: an unprivileged user with CAP_NET_ADMIN over a network namespace\n(e.g. via user namespaces) leaks one nf_connlabels reference per failed\nRTM_NEWACTION on the two error paths; net->ct.labels_used is never\nreleased.\n\nThe err: label is safe to reach from both sites: p->tmpl is still NULL\nthere (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so\nno inline release is needed."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"13b561c893c741635adce3781490a7a1099106c8","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"1d51aff78f078af1a80e9496c2f4643f4c0ef0a0","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","status":"affected","lessThan":"16e088016f38cf728a0de709c3335cc5a3850476","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/act_ct.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.7","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/act_ct.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/13b561c893c741635adce3781490a7a1099106c8"},{"url":"https://git.kernel.org/stable/c/1d51aff78f078af1a80e9496c2f4643f4c0ef0a0"},{"url":"https://git.kernel.org/stable/c/0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4"},{"url":"https://git.kernel.org/stable/c/16e088016f38cf728a0de709c3335cc5a3850476"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:14:29.962Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}