Linux kernel BPF conntrack kfuncs: racing opts update unbalances the netns reference count

Impact

__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when taking and releasing the namespace reference, and opts can point into a shared map value that another CPU is writing. A concurrent flip either leaks a reference or performs a put_net() with no matching get; repeating the unmatched put destroys a live network namespace and crashes a later user. The kernel report shows a general protection fault with a KASAN null-pointer-deref during a BPF program test run. This lives in the conntrack kfuncs that CNI and network-policy datapaths use, so a fault takes down the node's networking and the node with it.

Who can reach it

Requires a loaded BPF program calling the conntrack kfuncs with opts in a shared map value - CAP_BPF/CAP_NET_ADMIN, i.e. the cluster network datapath or a privileged agent, not a tenant pod. Triggering the imbalance needs concurrent writes to that map value while the kfunc runs.

What to do

Update to a stable kernel carrying the READ_ONCE() snapshot fix and reboot. No user-space knob mitigates this short of not running BPF programs that pass a shared map value as opts, which is a change to the CNI datapath rather than an operator setting. Fold it into the next kernel roll.

References

Related entries

• Linux kernel SMC-R: duplicate LLC link messages from a peer leak one kmalloc-96 object eachCVE-2026-74719 · Linux kernel SMC-R LLC event handler (duplicate CONFIRM_LINK / ADD_LINK_CONT qentry)Unscored
• Linux kernel BPF verifier: commuted pointer arithmetic loses pointer provenance stateCVE-2026-74720 · Linux kernel BPF verifier (adjust_ptr_min_max_vals, scalar += pointer)Unscored
• Linux kernel sched_ext: a failed sub-scheduler enable races root disable into a use-after-freeCVE-2026-74731 · Linux kernel sched_ext (scx_sub_disable teardown of never-linked sub-schedulers)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical