{"apiVersion":"1.0","identifier":"CVE-2026-72430","description":"In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix nf_connlabels leak on two error paths tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when TCA_CT_LABELS is present, but two later error sites use a bare return instead of -goto err-, skipping the err: nf_connlabels_put() cleanup. They also precede the -p->put_labels = put_labels- assignment, so the tcf_ct_params_free() fallback does not release the count either. Each failed RTM_NEWACTION on these paths leaks one nf_connlabels reference: net->ct.labels_used is incremented and never released. The action is reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged user namespace on default-userns kernels. Impact: an unprivileged user with CAP_NET_ADMIN over a network namespace (e.g. via user namespaces) leaks one nf_connlabels reference per failed RTM_NEWACTION on the two error paths; net->ct.labels_used is never released. The err: label is safe to reach from both sites: p->tmpl is still NULL there (kzalloc-d, not yet assigned) and nf_ct_put(NULL) is a no-op, so no inline release is needed.","publishedAt":"2026-08-15T06:22:16","lastModifiedAt":"2026-08-17T06:19:10","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72430","cvssScore":null,"cvssVector":"Pending","epssProbability":0.002,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72430","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72430","en":"https://www.redsauce.net/en/cves/CVE-2026-72430","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72430","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72430","de":"https://www.redsauce.net/de/cves/CVE-2026-72430","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72430","el":"https://www.redsauce.net/el/cves/CVE-2026-72430"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72430"}}