Executive brief
The Linux kernel's network namespace code had a resource leak when handling errors during namespace creation. Memory and other resources allocated by net_alloc() would not be properly released if initialization failed, potentially leading to memory exhaustion over time on systems that frequently create and destroy network namespaces (common in containerized environments). A patch reorders initialization steps to ensure all resources are correctly released on error paths.
Technical details
This vulnerability is a resource leak in the copy_net_ns() function's error handling path. The preinit_net() function was performing two sequential initialization tasks: calling ns_common_init() (which could fail) followed by resource initialization (which should not fail). When ns_common_init() failed, preinit_net() returned early, but copy_net_ns() would jump to a label that failed to call key_remove_domain() and net_passive_dec(), leaving resources allocated by net_alloc() unreleased. The fix decouples the ns_common_init() call from preinit_net(), converting preinit_net() to a void function and calling ns_common_init() separately. This allows the error handler to properly clean up all allocated resources by calling the put_userns_no_common label path. The vulnerability is triggered only when ns_common_init() fails during namespace creation, an error condition that may be rare in normal operation but becomes significant in high-churn containerized environments.
Affected products
- Linux Linux Kernel multiple versions across 2.6 through 7.x series
Timeline
- 2026-08-22: other: Patch authored by Tetsuo Handa
- 2026-09-17: disclosed
- 2026-08-25: patched: Merged to mainline by Paolo Abeni
- 2026-09-14: other: Backported to stable kernel