{"id":"CVE-2026-22994","title":"bpf: Fix reference count leak in bpf_prog_test_run_xdp()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for sit0 to become free. Usage count = 2\n\nproblem. A debu…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < 368569bc546d3368ee9980ba79fc42fdff9a3365","Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < 98676ee71fd4eafeb8be63c7f3f1905d40e03101","Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < fb9ef40cccdbacce36029b305d0ef1e12e4fea38","Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < 737be05a765761d7d7c9f7fe92274bd8e6f6951e","Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < ec69daabe45256f98ac86c651b8ad1b2574489a7","Linux 5.18"],"published":"2026-01-23","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:44:32.357Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-22994","references":[{"url":"https://git.kernel.org/stable/c/368569bc546d3368ee9980ba79fc42fdff9a3365"},{"url":"https://git.kernel.org/stable/c/98676ee71fd4eafeb8be63c7f3f1905d40e03101"},{"url":"https://git.kernel.org/stable/c/fb9ef40cccdbacce36029b305d0ef1e12e4fea38"},{"url":"https://git.kernel.org/stable/c/737be05a765761d7d7c9f7fe92274bd8e6f6951e"},{"url":"https://git.kernel.org/stable/c/ec69daabe45256f98ac86c651b8ad1b2574489a7"}],"tags":["cve.org"],"epss":0.00137,"epssPercentile":0.03471,"ingestedAt":"2026-09-08T15:33:26.994Z","slug":"CVE-2026-22994","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for sit0 to become free. Usage count = 2\n\nproblem. A debug printk() patch found that a refcount is obtained at\nxdp_convert_md_to_buff() from bpf_prog_test_run_xdp().\n\nAccording to commit ec94670fcb3b (\"bpf: Support specifying ingress via\nxdp_md context in BPF_PROG_TEST_RUN\"), the refcount obtained by\nxdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md().\n\nTherefore, we can consider that the error handling path introduced by\ncommit 1c1949982524 (\"bpf: introduce frags support to\nbpf_prog_test_run_xdp()\") forgot to call xdp_convert_buff_to_md().\n\n## Affected\n\n- `Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < 368569bc546d3368ee9980ba79fc42fdff9a3365`\n- `Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < 98676ee71fd4eafeb8be63c7f3f1905d40e03101`\n- `Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < fb9ef40cccdbacce36029b305d0ef1e12e4fea38`\n- `Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < 737be05a765761d7d7c9f7fe92274bd8e6f6951e`\n- `Linux >= 1c194998252469cad00a08bd9ef0b99fd255c260 < ec69daabe45256f98ac86c651b8ad1b2574489a7`\n- `Linux 5.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}