CVE-2026-90077: net: fix a resource leak in copy_net_ns() error handling path
In the Linux kernel, the following vulnerability has been resolved:
net: fix a resource leak in copynetns() error handling path
Currently, preinitnet() does two things:
(1) call nscommoninit() which might fail (2) initialize resources which does not fail
However, preinitnet() is returning early when (1) fails, and copynetns() is jumping to the decucounts: label. As a result, resources allocated by netalloc() are leaking. We need to call keyremovedomain() and netpassivedec() in order to release resources allocated by netalloc().
We cannot simply jump to the putuserns: label when preinitnet() failed, for (2) is not yet done. But we can reorder (1) and (2), for there is no dependency between (1) and (2). Therefore, this patch decouples (1) from preinitnet() and changes preinitnet() back to a void function, and calls nscommoninit() after preinitnet() succeeded. Then, we can jump to immediately after nscommonfree() of the putuserns: label.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the leak?
The leak occurs when copy_net_ns() allocates network-namespace resources through net_alloc() and ns_common_init() then fails. The existing error path decrements ucounts without releasing the resources allocated by net_alloc().
Are successful network namespace creation paths implicated?
The described issue is limited to the error-handling path following a failure of ns_common_init(). The provided information does not indicate a leak when that initialization succeeds.