CVE-2026-74715

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Fix netns reference imbalance in conntrack kfuncs<br /> <br /> The opts argument of the BPF conntrack kfuncs can point to a shared<br /> map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read<br /> opts-&gt;netns_id separately when acquiring and releasing the network<br /> namespace reference.<br /> <br /> The reference imbalance can occur as follows:<br /> <br /> CPU 0 CPU 1<br /> read opts-&gt;netns_id (-1)<br /> skip get_net_ns_by_id()<br /> write opts-&gt;netns_id (id)<br /> read opts-&gt;netns_id (id)<br /> put_net(net) /* no matching get */<br /> <br /> The reverse transition leaks the reference. Repeating the unmatched put<br /> can destroy a live namespace and crash later users.<br /> <br /> The kernel reported:<br /> <br /> Oops: general protection fault, probably for non-canonical address<br /> KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]<br /> RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700<br /> Call Trace:<br /> __sys_bpf+0x1662/0x50c0<br /> __x64_sys_bpf+0x73/0xb0<br /> do_syscall_64+0xf9/0x540<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> Kernel panic - not syncing: Fatal exception<br /> <br /> Snapshot every input field of opts with READ_ONCE() before validating or<br /> using it. The netns_id snapshot keeps the namespace get/put pair<br /> balanced, while the other snapshots keep the remaining options from<br /> changing partway through an invocation. The individual reads can still<br /> observe an inconsistent combination during a concurrent update, but each<br /> selected field value remains stable for that invocation.