CVE-2026-72430 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: fix nf_connlabels leak on two error paths
tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when TCA_CT_LABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err: nf_connlabels_put() cleanup. They also precede the "p->put_labels = put_labels" assignment, so the tcf_ct_params_free() fallback does not release the count either. Each failed RTM_NEWACTION on these paths leaks one nf_connlabels reference: net->ct.labels_used is incremented and never released. The action is reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged user namespace on default-userns kernels.
Impact: an unprivileged user with CAP_NET_ADMIN over a network namespace (e.g. via user namespaces) leaks one nf_connlabels reference per failed RTM_NEWACTION on the two error paths; net->ct.labels_used is never released.
The err: label is safe to reach from both sites: p->tmpl is still NULL there (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so no inline release is needed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability represents a resource management flaw within the Linux kernel networking subsystem, specifically in the connection tracking action module located at net/sched/act_ct.c. The issue arises during the processing of Netlink messages used to configure traffic control actions for connection tracking. When an application requests the configuration of CT labels via the TCA_CT_LABELS attribute, the function tcf_ct_fill_params invokes nf_connlabels_get to acquire a reference count on the label set associated with the network namespace's connection tracking subsystem. This operation increments net->ct.labels_used, signaling that additional resources are now in use and must be properly released when no longer needed. The core technical flaw lies in the error handling logic within this function, where two distinct failure paths utilize direct return statements instead of jumping to a designated cleanup label labeled err.
The consequence of using bare returns rather than structured goto-based cleanup is that the subsequent nf_connlabels_put call, which resides at the err label, is bypassed entirely. Furthermore, because these error sites are positioned before the assignment p->put_labels = put_labels in the code flow, the fallback mechanism within tcf_ct_params_free cannot detect that a reference was acquired and therefore fails to release it either. This results in a persistent memory leak where each failed RTM_NEWACTION request on these specific paths leaves one nf_connlabels reference unreleased. Over time, repeated exploitation of this flaw by an attacker can lead to the exhaustion of connection tracking label resources within the affected network namespace, potentially degrading system performance or causing denial of service conditions for legitimate traffic processing operations that rely on accurate state tracking and labeling mechanisms.
From a threat modeling perspective, this vulnerability is significant because it allows privilege escalation in terms of resource consumption without requiring root privileges at the host level. The action controlled by act_ct is reachable via CAP_NET_ADMIN capabilities over a network namespace. On systems utilizing default user namespaces, unprivileged users can create isolated network namespaces and acquire NET_ADMIN capabilities within them through standard containerization or user namespace features. This means that an attacker with limited system access can trigger this leak repeatedly to consume kernel memory resources associated with connection tracking labels. The vulnerability maps closely to CWE-401, which describes a missing release of resource after effective use, as well as CWE-755, concerning improper handling of unusual or exceptional conditions where error paths fail to clean up allocated state. In the context of the MITRE ATT&CK framework, this behavior aligns with techniques related to Resource Hijacking and Denial of Service via local exploitation, specifically leveraging kernel-level resource exhaustion to impact system stability.
The mitigation strategy primarily involves applying the upstream Linux kernel patch that corrects these error handling paths by replacing bare returns with jumps to the err label. This ensures that nf_connlabels_put is always called when a reference has been acquired but an error occurs before successful configuration completion. For administrators unable to immediately update their kernels, monitoring for unusual spikes in connection tracking resource usage within specific network namespaces can serve as a detection mechanism. Additionally, restricting CAP_NET_ADMIN capabilities to only those processes and users that strictly require them reduces the attack surface available to potential exploiters. Regular auditing of kernel updates and ensuring timely application of security patches is essential to prevent this type of persistent resource leak from impacting production environments.