CVE-2026-90077: net: fix a resource leak in copy_net_ns() error handling path
In the Linux kernel, the following vulnerability has been resolved:
net: fix a resource leak in copynetns() error handling path
Currently, preinitnet() does two things:
(1) call nscommoninit() which might fail (2) initialize resources which does not fail
However, preinitnet() is returning early when (1) fails, and copynetns() is jumping to the decucounts: label. As a result, resources allocated by netalloc() are leaking. We need to call keyremovedomain() and netpassivedec() in order to release resources allocated by netalloc().
We cannot simply jump to the putuserns: label when preinitnet() failed, for (2) is not yet done. But we can reorder (1) and (2), for there is no dependency between (1) and (2). Therefore, this patch decouples (1) from preinitnet() and changes preinitnet() back to a void function, and calls nscommoninit() after preinitnet() succeeded. Then, we can jump to immediately after nscommonfree() of the putuserns: label.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Fix copy_net_ns() error handling by decoupling ns_common_init() from preinit_net(), changing preinit_net() back to a void function, calling ns_common_init() after preinit_net() succeeds, and calling key_remove_domain() and net_passive_dec() when initialization fails to release resources allocated by net_alloc().
Event History
Frequently Asked Questions
What condition triggers the leak?
The leak occurs when copy_net_ns() allocates network-namespace resources through net_alloc() and ns_common_init() then fails. The existing error path decrements ucounts without releasing the resources allocated by net_alloc().
Are successful network namespace creation paths implicated?
The described issue is limited to the error-handling path following a failure of ns_common_init(). The provided information does not indicate a leak when that initialization succeeds.