Executive brief
The Linux kernel's BPF conntrack functions contain a reference counting bug that can leak network namespace resources or crash the system. Under concurrent access, mismatched get/put operations on network namespace references can destroy active namespaces, leading to kernel panics and system instability.
Technical details
The vulnerability is a reference counting imbalance in __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() BPF kfuncs. When the opts argument points to a shared map value, concurrent CPU access can cause the netns_id field to change between reads, leading to unmatched get_net_ns_by_id() and put_net() calls. This allows a reference leak (when transitioning from -1 to a valid ID) or an unmatched put (when transitioning from a valid ID to -1), either destroying a live namespace or corrupting reference counts. The fix uses READ_ONCE() to snapshot all opts fields, ensuring each field value remains stable within a single invocation despite concurrent modifications.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-22: disclosed
- 2026-08-22: patched: Fix applied using READ_ONCE() snapshots