UBUNTU-CVE-2026-74715: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup() and bpfnfctallocentry() read opts->netnsid separately when acquiring and releasing the network namespace reference. The reference imbalance can occur as follows: CPU 0 CPU 1 read opts->netnsid (-1) skip getnetnsbyid() write opts->netnsid (id) read opts->netnsid (id) putnet(net) / no matching get / The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users. The kernel reported: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] RIP: 0010:bpfprogtestrunxdp+0x52c/0x1700 Call Trace: sysbpf+0x1662/0x50c0 x64sysbpf+0x73/0xb0 dosyscall64+0xf9/0x540 entrySYSCALL64afterhwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception Snapshot every input field of opts with READONCE() before validating or using it. The netnsid snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.