{"id":"CVE-2026-74715","state":"PUBLISHED","title":"bpf: Fix netns reference imbalance in conntrack kfuncs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix netns reference imbalance in conntrack kfuncs\n\nThe opts argument of the BPF conntrack kfuncs can point to a shared\nmap value.  __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read\nopts->netns_id separately when acquiring and releasing the network\nnamespace reference.\n\nThe reference imbalance can occur as follows:\n\n  CPU 0                                  CPU 1\n  read opts->netns_id (-1)\n  skip get_net_ns_by_id()\n                                         write opts->netns_id (id)\n  read opts->netns_id (id)\n  put_net(net) /* no matching get */\n\nThe reverse transition leaks the reference.  Repeating the unmatched put\ncan destroy a live namespace and crash later users.\n\nThe kernel reported:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n  RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700\n  Call Trace:\n   __sys_bpf+0x1662/0x50c0\n   __x64_sys_bpf+0x73/0xb0\n   do_syscall_64+0xf9/0x540\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  Kernel panic - not syncing: Fatal exception\n\nSnapshot every input field of opts with READ_ONCE() before validating or\nusing it.  The netns_id snapshot keeps the namespace get/put pair\nbalanced, while the other snapshots keep the remaining options from\nchanging partway through an invocation.  The individual reads can still\nobserve an inconsistent combination during a concurrent update, but each\nselected field value remains stable for that invocation.","publishedAt":"2026-08-22T15:33:10.262Z","updatedAt":"2026-10-30T12:30:22.773Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"cfde990193135a35637e55f69e83e4ab441e60ab","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"41731d4290400cb898f15f049ae4018d45415e69","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"4af94462c0ca2187a02a1a6641020ae888c74d5c","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"e5e060eb63d10b41ab60fd955649479d99b38210","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"fdeba03fea78407a8c52faa99177c9f7f29f90eb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]}],"references":["https://git.kernel.org/stable/c/cfde990193135a35637e55f69e83e4ab441e60ab","https://git.kernel.org/stable/c/fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8","https://git.kernel.org/stable/c/41731d4290400cb898f15f049ae4018d45415e69","https://git.kernel.org/stable/c/4af94462c0ca2187a02a1a6641020ae888c74d5c","https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210","https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb"],"weaknesses":[],"ingestedAt":"2026-10-30T12:48:04.825Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74715.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74715","state":"PUBLISHED","datePublished":"2026-08-22T15:33:10.262Z","dateUpdated":"2026-10-30T12:30:22.773Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.928Z"},"containers":{"cna":{"title":"bpf: Fix netns reference imbalance in conntrack kfuncs","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix netns reference imbalance in conntrack kfuncs\n\nThe opts argument of the BPF conntrack kfuncs can point to a shared\nmap value.  __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read\nopts->netns_id separately when acquiring and releasing the network\nnamespace reference.\n\nThe reference imbalance can occur as follows:\n\n  CPU 0                                  CPU 1\n  read opts->netns_id (-1)\n  skip get_net_ns_by_id()\n                                         write opts->netns_id (id)\n  read opts->netns_id (id)\n  put_net(net) /* no matching get */\n\nThe reverse transition leaks the reference.  Repeating the unmatched put\ncan destroy a live namespace and crash later users.\n\nThe kernel reported:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n  RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700\n  Call Trace:\n   __sys_bpf+0x1662/0x50c0\n   __x64_sys_bpf+0x73/0xb0\n   do_syscall_64+0xf9/0x540\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  Kernel panic - not syncing: Fatal exception\n\nSnapshot every input field of opts with READ_ONCE() before validating or\nusing it.  The netns_id snapshot keeps the namespace get/put pair\nbalanced, while the other snapshots keep the remaining options from\nchanging partway through an invocation.  The individual reads can still\nobserve an inconsistent combination during a concurrent update, but each\nselected field value remains stable for that invocation."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"cfde990193135a35637e55f69e83e4ab441e60ab","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"41731d4290400cb898f15f049ae4018d45415e69","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"4af94462c0ca2187a02a1a6641020ae888c74d5c","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"e5e060eb63d10b41ab60fd955649479d99b38210","versionType":"git"},{"version":"aed8ee7feb44b6537af1e0b4f03365d42928be38","status":"affected","lessThan":"fdeba03fea78407a8c52faa99177c9f7f29f90eb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/cfde990193135a35637e55f69e83e4ab441e60ab"},{"url":"https://git.kernel.org/stable/c/fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8"},{"url":"https://git.kernel.org/stable/c/41731d4290400cb898f15f049ae4018d45415e69"},{"url":"https://git.kernel.org/stable/c/4af94462c0ca2187a02a1a6641020ae888c74d5c"},{"url":"https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210"},{"url":"https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in BPF conntrack kfuncs reached only via the bpf() syscall (load, BPF_PROG_TEST_RUN, or attached XDP/TC programs), not from remote packet handling alone; kernel guidance classifies BPF as Local.\nAC:L - Exploitation needs a race on opts->netns_id in a shared BPF map value, but the attacker authors the program, drives concurrent bpf_map_update_elem and kfunc calls, and can pin threads to different CPUs to win the race reliably.\nPR:L - Triggering bpf_xdp_ct_lookup/bpf_skb_ct_lookup requires loading XDP or TC-BPF programs, which needs CAP_BPF and CAP_NET_ADMIN; both are obtainable by an unprivileged user inside a user/network namespace via unshare.\nUI:N - No victim interaction is required; the attacker loads their own BPF program, supplies map-backed opts, and runs concurrent test-run or traffic to trigger the refcount imbalance themselves.\nS:U - Impact is premature destruction of a live network namespace and kernel crashes within the same kernel security domain; it does not cross a VM, container-to-host, or IOMMU boundary.\nC:H - Repeated unmatched put_net() can drop a live namespace refcount to zero and free it while still in use, creating a net-namespace use-after-free that can expose freed kernel memory and enable information disclosure.\nI:H - The refcount corruption can destroy active network namespaces and corrupt kernel networking state; such lifetime bugs are memory corruption primitives that can be leveraged for arbitrary kernel modification or control-flow hijacking.\nA:H - The fix commit documents a reproduced general protection fault and kernel panic in bpf_prog_test_run_xdp from a null-ptr-deref after the namespace is destroyed, confirming complete system availability loss."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:30:22.773Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74715","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:15:29.946901Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:16:11.506Z"}}]}}}