CVE-2026-74715 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix netns reference imbalance in conntrack kfuncs
The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when acquiring and releasing the network namespace reference.
The reference imbalance can occur as follows:
CPU 0 CPU 1 read opts->netns_id (-1) skip get_net_ns_by_id() write opts->netns_id (id) read opts->netns_id (id) put_net(net) /* no matching get */
The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users.
The kernel reported:
Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700 Call Trace: __sys_bpf+0x1662/0x50c0 __x64_sys_bpf+0x73/0xb0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception
Snapshot every input field of opts with READ_ONCE() before validating or using it. The netns_id snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel vulnerability identified in the BPF conntrack kfuncs represents a critical race condition within the network namespace reference management logic. This flaw specifically affects functions such as __bpf_nf_ct_lookup and __bpf_nf_ct_alloc_entry, which interact with connection tracking subsystems via eBPF programs. The core issue stems from how these kernel functions handle the opts argument, which can point to a shared map value accessible by multiple concurrent execution contexts. When acquiring or releasing network namespace references, the code reads the netns_id field separately for each operation rather than capturing it atomically at the start of the function invocation. This lack of atomicity allows for a scenario where one CPU core reads an initial state while another modifies that shared data structure in between operations, leading to inconsistent reference counting behavior.
The operational impact of this race condition is severe and can lead to system instability or denial of service conditions. In a typical exploitation sequence, the first read might observe a netns_id value indicating no valid namespace exists, causing the kernel to skip acquiring a network namespace reference via get_net_ns_by_id. Subsequently, another CPU core updates the shared opts structure with a valid identifier. The original execution path then proceeds to release what it believes is an acquired reference by calling put_net(net). However, since no corresponding get operation was performed due to the initial stale read, this results in an unmatched put call. This imbalance causes the kernel to decrement the reference count of a network namespace that may still be actively used by other processes or subsystems. Repeated occurrences can drive the reference count to zero prematurely, resulting in the destruction of a live network namespace and subsequent crashes for users attempting to access resources within that namespace.
The technical manifestation of this vulnerability is evident in kernel crash logs showing general protection faults and null pointer dereferences. The system may report errors such as KASAN detecting a null-ptr-deref or trigger fatal exceptions leading to kernel panics during BPF program execution, particularly when running XDP tests via sys_bpf calls. These symptoms indicate that the memory management subsystem has been compromised due to improper handling of dynamic resource references. The vulnerability aligns with CWE-362, which describes concurrent access resulting in race conditions, and specifically relates to improper synchronization mechanisms within kernel-space code. From a threat modeling perspective using MITRE ATT&CK for Enterprise or ICS, this flaw could be leveraged by an attacker who has the ability to load eBPF programs to cause denial of service against the host system, potentially disrupting network connectivity or causing complete node failure depending on the criticality of the affected namespace.
To mitigate this vulnerability and restore stability to the BPF conntrack subsystem, developers implemented a fix that involves snapshotting every input field of the opts structure using READ_ONCE() before any validation or usage occurs within the function scope. This approach ensures that each individual read operation captures a stable value for that specific invocation, even if concurrent updates are modifying other parts of the shared map value. By keeping the netns_id snapshot consistent throughout the acquisition and release phases, the reference counting logic remains balanced, preventing both leaks and premature decrements. While this fix does not prevent an observer from seeing inconsistent combinations of fields during a highly contended window, it guarantees that each field read is atomic with respect to its own usage within the function call. This ensures that if a get_net_ns_by_id operation was triggered based on one snapshot value, the corresponding put_net operation will use the same consistent context, thereby preserving the integrity of network namespace references and preventing system crashes.