CVE-2026-74718 Overview
CVE-2026-74718 is a net namespace reference leak in the Linux kernel's devlink subsystem. The flaw resides in devlink_nl_reload_doit(), which calls devlink_netns_get() and receives a net structure with a held reference. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing that reference. Repeated invocation of the affected code path leaks kernel memory associated with network namespaces. The upstream fix adds the missing put_net() call on this error path.
Critical Impact
Repeated triggering of the leak can exhaust kernel resources tied to network namespace references, contributing to denial-of-service conditions on affected hosts.
Affected Products
- Linux kernel builds containing the vulnerable devlink_nl_reload_doit() implementation
- Distributions shipping kernels prior to the stable patches referenced by the Linux kernel maintainers
- Systems exposing devlink netlink operations to privileged local users or orchestration agents
Discovery Timeline
- 2026-08-22 - CVE-2026-74718 published to NVD
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74718
Vulnerability Analysis
The defect is a kernel memory leak in the devlink netlink command handler devlink_nl_reload_doit(). The handler retrieves a target network namespace via devlink_netns_get(), which increments the reference count on the returned struct net. The handler then validates the requested reload action against the target namespace. When the caller specifies a namespace different from the current one and the reload action is not DEVLINK_RELOAD_ACTION_DRIVER_REINIT, the function returns -EOPNOTSUPP immediately. The early return path omits the corresponding put_net() call, orphaning the reference. Each triggering call leaks one namespace reference. Because struct net cannot be freed while references remain, the associated namespace and its network resources persist beyond their intended lifetime.
Root Cause
The root cause is a missing reference-count release on an error path, a common class of kernel resource management defects. The acquisition of the namespace reference and its release were not paired across all return branches within devlink_nl_reload_doit(). The corrective patches add put_net() before the -EOPNOTSUPP return so the reference is balanced on every exit path.
Attack Vector
Triggering the leak requires the ability to issue devlink reload netlink requests, which typically requires CAP_NET_ADMIN on the host. A privileged local process or container escape scenario that reaches the devlink interface can repeatedly submit reload requests targeting a foreign namespace with an unsupported action. Each rejected request leaks a namespace reference, gradually consuming kernel memory and blocking namespace teardown. The vulnerability does not provide code execution or privilege escalation on its own. The upstream fix is distributed across the kernel patches 1c4dac9bf1d2, 7b02c6d2a3cd, 7b6552e53426, bf0797b92be5, and eda60c85b4f4.
No verified public exploit or proof-of-concept code is available. See the Kernel Patch 1c4dac9bf1 for the authoritative fix.
Detection Methods for CVE-2026-74718
Indicators of Compromise
- Growing kernel memory usage attributable to net_namespace slab allocations without a corresponding increase in active namespaces.
- Network namespaces that fail to be reclaimed after their creating process exits or their containers terminate.
- Repeated devlink dev reload netlink requests returning -EOPNOTSUPP in audit or netlink trace logs.
Detection Strategies
- Monitor /proc/slabinfo for anomalous growth in net_namespace and related slab caches on long-running hosts.
- Track the count of active namespaces via ip netns list and compare against expected orchestration state.
- Audit netlink activity for high-frequency DEVLINK_CMD_RELOAD calls issued by workloads that do not legitimately require them.
Monitoring Recommendations
- Alert on sustained increases in kernel non-reclaimable memory that correlate with container or namespace churn.
- Log invocations of privileged netlink families such as NETLINK_GENERIC targeting devlink from unexpected processes.
- Correlate host-level memory pressure events with devlink command telemetry to identify abuse patterns.
How to Mitigate CVE-2026-74718
Immediate Actions Required
- Apply the stable kernel updates referenced by the upstream patches and reboot affected hosts.
- Restrict CAP_NET_ADMIN to trusted workloads and remove it from container runtimes that do not require it.
- Audit orchestration components and agents that issue devlink reload commands to ensure they cannot be abused.
Patch Information
The fix is available in the following upstream commits: Kernel Patch 1c4dac9bf1, Kernel Patch 7b02c6d2a3cd, Kernel Patch 7b6552e5342, Kernel Patch bf0797b92be5, and Kernel Patch eda60c85b4f4. Each patch adds the missing put_net() call on the -EOPNOTSUPP error path in devlink_nl_reload_doit().
Workarounds
- Limit access to the devlink netlink interface by dropping CAP_NET_ADMIN from unprivileged containers and service accounts.
- Use seccomp or Landlock policies to block devlink reload operations from workloads that do not require them.
- Reboot affected hosts periodically to reclaim leaked namespace references until patched kernels are deployed.
# Verify running kernel version and confirm the fix is present
uname -r
# Example: drop CAP_NET_ADMIN when launching an untrusted container
docker run --cap-drop=NET_ADMIN --rm -it <image>
# Inspect namespace-related slab usage for signs of leakage
sudo grep -E 'net_namespace|nsproxy' /proc/slabinfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
