CVE-2026-74715

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when acquiring and releasing the network namespace reference. The reference imbalance can occur as follows: CPU 0 CPU 1 read opts->netns_id (-1) skip get_net_ns_by_id() write opts->netns_id (id) read opts->netns_id (id) put_net(net) /* no matching get */ The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users. The kernel reported: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] RIP: 0010:bpf_prog_test_run_xdp+0x52c/0x1700 Call Trace: __sys_bpf+0x1662/0x50c0 __x64_sys_bpf+0x73/0xb0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception Snapshot every input field of opts with READ_ONCE() before validating or using it. The netns_id snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.

• https://git.kernel.org/stable/c/41731d4290400cb898f15f049ae4018d45415e69
• https://git.kernel.org/stable/c/4af94462c0ca2187a02a1a6641020ae888c74d5c
• https://git.kernel.org/stable/c/cfde990193135a35637e55f69e83e4ab441e60ab
• https://git.kernel.org/stable/c/e5e060eb63d10b41ab60fd955649479d99b38210
• https://git.kernel.org/stable/c/fb22bedf0c4f4f05bfa6e4a7ec0fd97bbdff9ce8
• https://git.kernel.org/stable/c/fdeba03fea78407a8c52faa99177c9f7f29f90eb

Published

Aug 22, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7471GitLab has remediated an issue in GitLab EE affecting all ve…3.5
• CVE-2026-74710In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74711In the Linux kernel, the following vulnerability has been re…8.4
• CVE-2026-74712In the Linux kernel, the following vulnerability has been re…9.3
• CVE-2026-74713In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-74714In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-74716In the Linux kernel, the following vulnerability has been re…
• CVE-2026-74717In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-74718In the Linux kernel, the following vulnerability has been re…
• CVE-2026-74719In the Linux kernel, the following vulnerability has been re…
• CVE-2026-7472The Read More & Accordion plugin for WordPress is vulnerable…4.9
• CVE-2026-74720In the Linux kernel, the following vulnerability has been re…7.8