CVE-2026-74715: bpf: Fix netns reference imbalance in conntrack kfuncs
bpf: Fix netns reference imbalance in conntrack kfuncs
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9
Event History
Frequently Asked Questions
Which deployments are exposed to the reference imbalance?
The issue applies when BPF conntrack kfuncs use an opts argument that can point to a shared map value and its netns_id is changed concurrently. The race occurs when one CPU reads one netns_id value while another CPU updates it before the namespace reference is released.
What is the practical impact of triggering the race?
An unmatched put can destroy a network namespace that is still live, causing later users of that namespace to crash. Repeated triggering can lead to a kernel general-protection fault, KASAN null-pointer dereference, and kernel panic.
Are there indicators that this issue may already have been triggered?
Reported symptoms include a general protection fault and KASAN null-pointer dereference in bpf_prog_test_run_xdp, followed by a fatal kernel exception or panic. These symptoms indicate a crash path described for this issue, but the provided information does not establish them as unique indicators.