CVE-2026-74715

A flaw was found in the kernel. A reference imbalance vulnerability exists in the Berkeley Packet Filter (BPF) conntrack kfuncs. This occurs when the 'opts' argument, which can point to a shared map value, has its network namespace identifier (netns_id) read separately during reference acquisition and release. A concurrent update can lead to an unmatched release, which can destroy a live network namespace. This issue can result in a kernel panic and a system crash, effectively causing a Denial of Service.

BPF conntrack kfuncs can read opts netns_id more than once while opts points to a shared BPF map value that can be modified concurrently. A racing update can make the function skip get_net_ns_by_id but later execute put_net, or can make the reverse transition leak a namespace reference. The unmatched put can destroy a live network namespace and later users may dereference invalid namespace state, causing a kernel crash and creating a plausible use-after-free lifetime hazard. For the CVSS the PR:L is selected because a local user or service with BPF related privileges is needed to load or run the affected BPF program and update the shared map value. The issue is not directly network reachable, although packet processing may exercise the already loaded BPF program. Impact is at least local denial of service via kernel panic, and the paranoid score treats the namespace lifetime corruption as a potential confidentiality and integrity risk that should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.