CVE-2026-22994: bpf: Fix reference count leak in bpf_prog_test_run_xdp()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix reference count leak in bpfprogtestrunxdp()
syzbot is reporting
unregisternetdevice: waiting for sit0 to become free. Usage count = 2
problem. A debug printk() patch found that a refcount is obtained at xdpconvertmdtobuff() from bpfprogtestrunxdp().
According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdpmd context in BPFPROGTESTRUN"), the refcount obtained by xdpconvertmdtobuff() will be released by xdpconvertbufftomd().
Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpfprogtestrunxdp()") forgot to call xdpconvertbufftomd().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22994?
The severity of CVE-2026-22994 is classified as moderate due to the reference count leak in the Linux kernel.
How do I fix CVE-2026-22994?
To fix CVE-2026-22994, you should update the Linux kernel to the latest version that includes the patch for this vulnerability.
Which systems are affected by CVE-2026-22994?
CVE-2026-22994 affects the Linux kernel where the bpf_prog_test_run_xdp() function is utilized.
What are the symptoms of CVE-2026-22994?
Symptoms of CVE-2026-22994 include potential delays in network device unregistration due to reference count issues.
Is CVE-2026-22994 a remote or local vulnerability?
CVE-2026-22994 is considered a local vulnerability, as it requires local access to exploit the reference count leak.