Look up another CVE · open CVE-2026-74715 in the interactive tracker

CVE-2026-74715

bpf: Fix netns reference imbalance in conntrack kfuncs

7.8 EPSS 0.2% AV:L

Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem net/netfilter. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-74715 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	vulnerable	6.12.113-1	No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication.
Debian 14forky	fixed	7.1.9-1	Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.9-1	Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when acquiring and releasing the network namespace reference. The reference imbalance can occur as follows: CPU 0 CPU 1 read opts->netns_id (-1) skip get_net_ns_by_id() write opts->netns_id (id) read opts->netns_id (id) put_net(net) /* no matching get */ The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users. The kernel reported: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700 Call Trace: __sys_bpf+0x1662/0x50c0 __x64_sys_bpf+0x73/0xb0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception Snapshot every input field of opts with READ_ONCE() before validating or using it. The netns_id snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/netfilter/nf_conntrack_bpf.c

What this is: NETFILTERMAINTAINERS section matched on net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
Kernel module: nf_conntrack

Check it on the machine

grep -wE 'CONFIG_DEBUG_INFO_BTF|CONFIG_DEBUG_INFO_BTF_MODULES|CONFIG_NETFILTER|CONFIG_NF_CONNTRACK' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w nf_conntrack

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormMnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
trixieMnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
forky, sidMnot built on armhf/armmp, armhf/armmp-lpae, loong64/loong64

M: a module where it is built at all; some flavours do not build it

Build switches: CONFIG_DEBUG_INFO_BTF, CONFIG_DEBUG_INFO_BTF_MODULES, CONFIG_NETFILTER, CONFIG_NF_CONNTRACK
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-22 (2 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.17%, higher than 6.3% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: net/netfilter

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.0	6.18.57	4af94462c0ca
6.0	7.1.9	e5e060eb63d1
6.0	7.2	fdeba03fea78

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The bug is in BPF conntrack kfuncs reached only via the bpf() syscall (load, BPF_PROG_TEST_RUN, or attached XDP/TC programs), not from remote packet handling alone; kernel guidance classifies BPF as Local.
AC:LAttack complexity, low: Exploitation needs a race on opts->netns_id in a shared BPF map value, but the attacker authors the program, drives concurrent bpf_map_update_elem and kfunc calls, and can pin threads to different CPUs to win the race reliably.
PR:LPrivileges required, low: Triggering bpf_xdp_ct_lookup/bpf_skb_ct_lookup requires loading XDP or TC-BPF programs, which needs CAP_BPF and CAP_NET_ADMIN; both are obtainable by an unprivileged user inside a user/network namespace via unshare.
UI:NUser interaction, none: No victim interaction is required; the attacker loads their own BPF program, supplies map-backed opts, and runs concurrent test-run or traffic to trigger the refcount imbalance themselves.
S:UScope, unchanged: Impact is premature destruction of a live network namespace and kernel crashes within the same kernel security domain; it does not cross a VM, container-to-host, or IOMMU boundary.
C:HConfidentiality impact, high: Repeated unmatched put_net() can drop a live namespace refcount to zero and free it while still in use, creating a net-namespace use-after-free that can expose freed kernel memory and enable information disclosure.
I:HIntegrity impact, high: The refcount corruption can destroy active network namespaces and corrupt kernel networking state; such lifetime bugs are memory corruption primitives that can be leveraged for arbitrary kernel modification or control-flow hijacking.
A:HAvailability impact, high: The fix commit documents a reproduced general protection fault and kernel panic in bpf_prog_test_run_xdp from a null-ptr-deref after the namespace is destroyed, confirming complete system availability loss.