Junglewise Threat Intelligence

CVE-2026-90077: Linux kernel resource leak in copy_net_ns() error handling

CVE-2026-90077 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's network namespace code had a resource leak when handling errors during namespace creation. Memory and other resources allocated by net_alloc() would not be properly released if initialization failed, potentially leading to memory exhaustion over time on systems that frequently create and destroy network namespaces (common in containerized environments). A patch reorders initialization steps to ensure all resources are correctly released on error paths.

Technical details

This vulnerability is a resource leak in the copy_net_ns() function's error handling path. The preinit_net() function was performing two sequential initialization tasks: calling ns_common_init() (which could fail) followed by resource initialization (which should not fail). When ns_common_init() failed, preinit_net() returned early, but copy_net_ns() would jump to a label that failed to call key_remove_domain() and net_passive_dec(), leaving resources allocated by net_alloc() unreleased. The fix decouples the ns_common_init() call from preinit_net(), converting preinit_net() to a void function and calling ns_common_init() separately. This allows the error handler to properly clean up all allocated resources by calling the put_userns_no_common label path. The vulnerability is triggered only when ns_common_init() fails during namespace creation, an error condition that may be rare in normal operation but becomes significant in high-churn containerized environments.

Affected products

  • Linux Linux Kernel multiple versions across 2.6 through 7.x series

Timeline

  • 2026-08-22: other: Patch authored by Tetsuo Handa
  • 2026-09-17: disclosed
  • 2026-08-25: patched: Merged to mainline by Paolo Abeni
  • 2026-09-14: other: Backported to stable kernel

References

Related threats