CVE-2026-74715
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when acquiring and releasing the network namespace reference. The reference imbalance can occur as follows: CPU 0 CPU 1 read opts->netns_id (-1) skip get_net_ns_by_id() write opts->netns_id (id) read opts->netns_id (id) put_net(net) /* no matching get */ The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users. The kernel reported: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700 Call Trace: __sys_bpf+0x1662/0x50c0 __x64_sys_bpf+0x73/0xb0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception Snapshot every input field of opts with READ_ONCE() before validating or using it. The netns_id snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-22 16:16:46.313000
Last modified
2026-10-30 13:20:04.647000
View original CVE JSON
{
"id": "CVE-2026-74715",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-22T16:16:46.313",
"lastModified": "2026-10-30T13:20:04.647",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix netns reference imbalance in conntrack kfuncs\n\nThe opts argument of the BPF conntrack kfuncs can point to a shared\nmap value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read\nopts->netns_id separately when acquiring and releasing the network\nnamespace reference.\n\nThe reference imbalance can occur as follows:\n\n CPU 0 CPU 1\n read opts->netns_id (-1)\n skip get_net_ns_by_id()\n write opts->netns_id (id)\n read opts->netns_id (id)\n put_net(net) /* no matching get */\n\nThe reverse transition leaks the reference. Repeating the unmatched put\ncan destroy a live namespace and crash later users.\n\nThe kernel reported:\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700\n Call Trace:\n __sys_bpf+0x1662/0x50c0\n __x64_sys_bpf+0x73/0xb0\n do_syscall_64+0xf9/0x540\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n Kernel panic - not syncing: Fatal exception\n\nSnapshot every input field of opts with READ_ONCE() before validating or\nusing it. The netns_id snapshot keeps the namespace get/put pair\nbalanced, while the other snapshots keep the remaining options from\nchanging partway through an invocation. The individual reads can still\nobserve an inconsistent combination during a concurrent update, but each\nselected field value remains stable for that invocation."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Soluciona el desequilibrio de referencia de netns en las kfuncs de conntrack\n\nEl argumento opts de las kfuncs de conntrack de BPF puede apuntar a un valor de mapa compartido. __bpf_nf_ct_lookup() y __bpf_nf_ct_alloc_entry() leen opts -> netns_id por separado al adquirir y liberar la referencia del espacio de nombres de red.\n\nEl desequilibrio de referencia puede ocurrir de la siguiente manera:\n\n CPU 0 CPU 1\n lee opts -> netns_id (-1)\n omite get_net_ns_by_id()\n escribe opts -> netns_id (id)\n lee opts -> netns_id (id)\n put_net(net) /* no hay 'get' coincidente */\n\nLa transición inversa filtra la referencia. Repetir el 'put' sin coincidencia puede destruir un espacio de nombres activo y provocar un fallo en usuarios posteriores.\n\nEl kernel informó:\n\n Oops: fallo de protección general, probablemente por dirección no canónica\n KASAN: null-ptr-deref en el rango [0x00000000000000e8-0x00000000000000ef]\n RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700\n Call Trace:\n __sys_bpf+0x1662/0x50c0\n __x64_sys_bpf+0x73/0xb0\n do_syscall_64+0xf9/0x540\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n Pánico del kernel - no sincronizando: Excepción fatal\n\nRealice una instantánea de cada campo de entrada de opts con READ_ONCE() antes de validarlo o usarlo. La instantánea de netns_id mantiene equilibrado el par 'get/put' del espacio de nombres, mientras que las otras instantáneas evitan que las opciones restantes cambien a mitad de una invocación. Las lecturas individuales aún pueden observar una combinación inconsistente durante una actualización concurrente, pero cada valor de campo seleccionado permanece estable para esa invocación."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"lessThan": "cfde990193135a35637e55f69e83e4ab441e60ab",
"versionType": "git",
"status": "affected"
},
{
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"lessThan": "fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8",
"versionType": "git",
"status": "affected"
},
{
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"lessThan": "41731d4290400cb898f15f049ae4018d45415e69",
"versionType": "git",
"status": "affected"
},
{
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"lessThan": "4af94462c0ca2187a02a1a6641020ae888c74d5c",
"versionType": "git",
"status": "affected"
},
{
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"lessThan": "e5e060eb63d10b41ab60fd955649479d99b38210",
"versionType": "git",
"status": "affected"
},
{
"version": "aed8ee7feb44b6537af1e0b4f03365d42928be38",
"lessThan": "fdeba03fea78407a8c52faa99177c9f7f29f90eb",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/netfilter/nf_conntrack_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.0",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.0",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.114",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.9",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T19:15:29.946901Z",
"id": "CVE-2026-74715",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41731d4290400cb898f15f049ae4018d45415e69",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4af94462c0ca2187a02a1a6641020ae888c74d5c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cfde990193135a35637e55f69e83e4ab441e60ab",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}