Linux Kernel eBPF Vulnerability Allows Kernel Panic

Status: UPDATED  |  Advisory ID: CVE-2026-74715

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix netns reference imbalance in conntrack kfuncs

The opts argument of the BPF conntrack kfuncs can point to a shared

map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read

opts->netns_id separately when acquiring and releasing the network

namespace reference.

The reference imbalance can occur as follows:

CPU 0 CPU 1

read opts->netns_id (-1)

skip get_net_ns_by_id()

write opts->netns_id (id)

read opts->netns_id (id)

put_net(net) /* no matching get */

The reverse transition leaks the reference. Repeating the unmatched put

can destroy a live namespace and crash later users.

The kernel reported:

Oops: general protection fault, probably for non-canonical address

KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]

RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700

Call Trace:

__sys_bpf+0x1662/0x50c0

__x64_sys_bpf+0x73/0xb0

do_syscall_64+0xf9/0x540

entry_SYSCALL_64_after_hwframe+0x77/0x7f

Kernel panic - not syncing: Fatal exception

Snapshot every input field of opts with READ_ONCE() before validating or

using it. The netns_id snapshot keeps the namespace get/put pair

balanced, while the other snapshots keep the remaining options from

changing partway through an invocation. The individual reads can still

observe an inconsistent combination during a concurrent update, but each

selected field value remains stable for that invocation. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References