---
id: CVE-2026-74715
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix netns reference imbalance in conntrack kfuncs

  The opts argument of the BPF conntrack kfuncs can point to a shared
  map value
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix netns reference imbalance in conntrack kfuncs

  The opts argument of the BPF conntrack kfuncs can point to a shared
  map value.  __bpf_nf_ct_lookup() and __bpf_n…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= aed8ee7feb44b6537af1e0b4f03365d42928be38 <
    4af94462c0ca2187a02a1a6641020ae888c74d5c
  - >-
    Linux >= aed8ee7feb44b6537af1e0b4f03365d42928be38 <
    e5e060eb63d10b41ab60fd955649479d99b38210
  - >-
    Linux >= aed8ee7feb44b6537af1e0b4f03365d42928be38 <
    fdeba03fea78407a8c52faa99177c9f7f29f90eb
  - Linux 6.0
published: '2026-08-22'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:48.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74715'
references:
  - url: 'https://git.kernel.org/stable/c/4af94462c0ca2187a02a1a6641020ae888c74d5c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8'
  - url: 'https://git.kernel.org/stable/c/41731d4290400cb898f15f049ae4018d45415e69'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74715.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-74715'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2521369'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-74715'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74715'
  - url: 'https://kernelcve.org/list/?q=CVE-2026-74715'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026082238-CVE-2026-74715-a8ca@gregkh/T
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00129
epssPercentile: 0.02481
ingestedAt: '2026-10-14T13:30:58.546Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:15:29.946901Z'
cwe:
  - CWE-416
scores:
  nvd: 7.8
  vendor: 4.7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix netns reference imbalance in conntrack kfuncs

The opts argument of the BPF conntrack kfuncs can point to a shared
map value.  __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
opts->netns_id separately when acquiring and releasing the network
namespace reference.

The reference imbalance can occur as follows:

  CPU 0                                  CPU 1
  read opts->netns_id (-1)
  skip get_net_ns_by_id()
                                         write opts->netns_id (id)
  read opts->netns_id (id)
  put_net(net) /* no matching get */

The reverse transition leaks the reference.  Repeating the unmatched put
can destroy a live namespace and crash later users.

The kernel reported:

  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
  RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700
  Call Trace:
   __sys_bpf+0x1662/0x50c0
   __x64_sys_bpf+0x73/0xb0
   do_syscall_64+0xf9/0x540
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  Kernel panic - not syncing: Fatal exception

Snapshot every input field of opts with READ_ONCE() before validating or
using it.  The netns_id snapshot keeps the namespace get/put pair
balanced, while the other snapshots keep the remaining options from
changing partway through an invocation.  The individual reads can still
observe an inconsistent combination during a concurrent update, but each
selected field value remains stable for that invocation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74715.json)