Executive brief
The Linux kernel's connection tracking (act_ct) module contains a resource leak in error handling paths that can be triggered by unprivileged users with network namespace capabilities. When certain network configuration operations fail, connection tracking label references are not properly released, allowing repeated attacks to exhaust system resources and degrade network filtering performance.
Technical details
This is a resource leak (CWE-404) in the tcf_ct_fill_params() function within net/sched/act_ct.c. When TCA_CT_LABELS is present, nf_connlabels_get() is called to increment a reference counter; however, two error paths use bare return statements instead of jumping to the cleanup label, bypassing nf_connlabels_put(). The cleanup also does not occur in tcf_ct_params_free() because the leak occurs before the put_labels flag is assigned. An unprivileged user with CAP_NET_ADMIN over a network namespace can trigger failed RTM_NEWACTION calls on these paths, leaking one nf_connlabels reference per attempt and incrementing net->ct.labels_used indefinitely. The fix redirects both error sites to a common error label that safely invokes cleanup.
Affected products
- Linux Linux kernel affected versions include at least 4.x through 6.x series (precise range varies by stable branch)
Timeline
- 2026-08-15: disclosed: CVE-2026-72430 published
- 2026-06-17: patched: Upstream patch authored by Michael Bommarito