{"apiVersion":"1.0","identifier":"CVE-2026-74715","description":"In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when acquiring and releasing the network namespace reference. The reference imbalance can occur as follows: CPU 0 CPU 1 read opts->netns_id (-1) skip get_net_ns_by_id() write opts->netns_id (id) read opts->netns_id (id) put_net(net) /* no matching get */ The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users. The kernel reported: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700 Call Trace: __sys_bpf+0x1662/0x50c0 __x64_sys_bpf+0x73/0xb0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception Snapshot every input field of opts with READ_ONCE() before validating or using it. The netns_id snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.","publishedAt":"2026-08-22T16:16:46","lastModifiedAt":"2026-08-25T06:18:57","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74715","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.0012,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74715","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74715","en":"https://www.redsauce.net/en/cves/CVE-2026-74715","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74715","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74715","de":"https://www.redsauce.net/de/cves/CVE-2026-74715","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74715","el":"https://www.redsauce.net/el/cves/CVE-2026-74715"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74715"}}