CVE-2026-74715: Linux Kernel Race Condition Vulnerability

CVE-2026-74715 Overview

CVE-2026-74715 is a race condition in the Linux kernel's BPF conntrack kernel functions (kfuncs). The vulnerability stems from a network namespace reference imbalance in __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry(). Both functions read the opts->netns_id field separately when acquiring and releasing the network namespace reference. Because the opts argument can point to a shared BPF map value, a concurrent writer can change netns_id between the acquire and release operations. The mismatched get_net_ns_by_id() and put_net() pair either leaks or over-releases a namespace reference, which can destroy a live namespace and crash the kernel.

Critical Impact
A local attacker with the ability to load BPF programs can trigger a general protection fault and kernel panic, leading to denial of service or potential privilege escalation.

Affected Products

Linux kernel with BPF conntrack kfunc support
Distributions shipping affected upstream kernels prior to the fix commits
Systems permitting unprivileged or CAP_BPF-scoped BPF program loading

Discovery Timeline

2026-08-22 - CVE-2026-74715 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74715

Vulnerability Analysis

The defect lives in the BPF netfilter conntrack helpers exposed to eBPF programs. The opts argument passed by a BPF program can reside in a shared map value that other CPUs write to concurrently. The affected helpers read opts->netns_id twice: once to call get_net_ns_by_id() when acquiring a namespace reference and a second time to decide whether to call put_net() on the release path.

When a second CPU mutates opts->netns_id between those two reads, the helper may skip the get but still perform the put, or perform the get and skip the matching put. The unmatched put_net() decrements the reference count of a namespace that the caller never acquired, eventually destroying a still-live namespace. Subsequent access to that namespace produces the reported KASAN null-pointer dereference in bpf_prog_test_run_xdp and a fatal Oops: general protection fault.

The upstream fix snapshots every input field of opts with READ_ONCE() before validating or using it. This keeps the get/put pair balanced and prevents any single field from changing partway through an invocation.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) race on a shared memory operand. The kernel read the same field twice from mutable BPF map memory without ordering guarantees, so the acquire and release paths could observe different values.

Attack Vector

Exploitation requires local access and the ability to load or run a BPF program that invokes the conntrack kfuncs with an opts argument backed by a shared map value. A cooperating writer on another CPU races the field to force the reference imbalance. See the upstream fix commit e5e060eb and backport fdeba03f for the exact code paths.

// No verified public exploit code is available.
// Refer to the upstream commits linked above for the patched call sites
// in __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry().

Detection Methods for CVE-2026-74715

Indicators of Compromise

Kernel log entries containing Oops: general protection fault with RIP pointing into bpf_prog_test_run_xdp or the BPF conntrack helpers
KASAN reports of null-ptr-deref in the address range 0x00000000000000e8-0x00000000000000ef during BPF syscall handling
Unexpected Kernel panic - not syncing: Fatal exception events on hosts running custom or third-party BPF programs

Detection Strategies

Audit loaded BPF programs (bpftool prog show) for use of bpf_ct_lookup, bpf_xdp_ct_lookup, bpf_skb_ct_lookup, and their allocation counterparts
Correlate BPF syscall activity from non-root users with kernel crash telemetry to identify race attempts
Track kernel version and patch level against the fix commits on all Linux endpoints and servers

Monitoring Recommendations

Forward dmesg, /var/log/kern.log, and crash dumps to a centralized logging or SIEM platform for kernel fault correlation
Alert on repeated BPF verifier or program load events from non-administrative accounts
Monitor CAP_BPF and CAP_SYS_ADMIN grants across container and workload manifests

How to Mitigate CVE-2026-74715

Immediate Actions Required

Apply the upstream kernel fix from commits e5e060eb and fdeba03f or install the distribution kernel update that includes them
Reboot affected systems after upgrading to activate the patched kernel image
Restrict BPF program loading to trusted administrative users where the fix cannot be applied immediately

Patch Information

The fix snapshots every input field of opts with READ_ONCE() before validating or using it, keeping the namespace get_net_ns_by_id() and put_net() pair balanced. Consult your distribution's security advisories for the specific kernel package versions that carry the backport.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs
Remove CAP_BPF and CAP_NET_ADMIN from workloads that do not require them, particularly in container runtimes
Disable or unload third-party BPF programs that call the conntrack kfuncs until the kernel is patched

bash

# Disable unprivileged BPF program loading
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/99-disable-unpriv-bpf.conf

# Verify installed kernel version after patching
uname -r