---
id: CVE-2026-74715
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix netns reference imbalance in conntrack kfuncs

  The opts argument of the BPF conntrack kfuncs can point to a shared
  map value
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix netns reference imbalance in conntrack kfuncs

  The opts argument of the BPF conntrack kfuncs can point to a shared
  map value.  __bpf_nf_ct_lookup() and __bpf_n…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74715'
references:
  - url: 'https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00165
epssPercentile: 0.05287
ingestedAt: '2026-10-14T13:30:58.546Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix netns reference imbalance in conntrack kfuncs

The opts argument of the BPF conntrack kfuncs can point to a shared
map value.  __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
opts->netns_id separately when acquiring and releasing the network
namespace reference.

The reference imbalance can occur as follows:

  CPU 0                                  CPU 1
  read opts->netns_id (-1)
  skip get_net_ns_by_id()
                                         write opts->netns_id (id)
  read opts->netns_id (id)
  put_net(net) /* no matching get */

The reverse transition leaks the reference.  Repeating the unmatched put
can destroy a live namespace and crash later users.

The kernel reported:

  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
  RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700
  Call Trace:
   __sys_bpf+0x1662/0x50c0
   __x64_sys_bpf+0x73/0xb0
   do_syscall_64+0xf9/0x540
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  Kernel panic - not syncing: Fatal exception

Snapshot every input field of opts with READ_ONCE() before validating or
using it.  The netns_id snapshot keeps the namespace get/put pair
balanced, while the other snapshots keep the remaining options from
changing partway through an invocation.  The individual reads can still
observe an inconsistent combination during a concurrent update, but each
selected field value remains stable for that invocation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.