Junglewise Threat Intelligence

CVE-2026-22994: Linux Kernel reference count leak in bpf_prog_test_run_xdp

CVE-2026-22994 · Severity: medium · CVSS 5.5 · Published 2026-01-23

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's BPF subsystem can lead to a system resource leak. This occurs when testing certain network programs, causing network devices to remain 'busy' and preventing them from being shut down or reconfigured. In practice, this can lead to a denial-of-service condition where system administrators are unable to manage network interfaces properly.

Technical details

A reference count leak exists in net/bpf/test_run.c within the bpf_prog_test_run_xdp() function. The vulnerability is caused by a missing call to xdp_convert_buff_to_md() in the error handling path introduced during the implementation of XDP fragments support. When xdp_convert_md_to_buff() obtains a reference to a netdevice, it expects a corresponding conversion back to release that reference; failing to do so during specific error conditions (such as memory allocation failures or user-copy errors) causes the netdevice usage count to remain incremented. This prevents the kernel from successfully executing unregister_netdevice(), hanging the process and potentially impacting system stability. Patches have been released for multiple stable kernel branches including 6.1.y, 6.6.y, and 6.12.y.

Affected products

  • Linux Linux Kernel 5.18 to 6.1.161, 6.6.72, 6.12.10, 6.13-rc7
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-01-08: disclosed: Initial patch submitted by Tetsuo Handa
  • 2026-01-17: patched: Patches committed to stable kernel trees
  • 2026-01-23: advisory: CVE published

References

Related threats