CVE-2026-72430

Received Received - Intake

Memory Leak in Linux Kernel Net Sched CT Action

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix nf_connlabels leak on two error paths tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when TCA_CT_LABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err: nf_connlabels_put() cleanup. They also precede the "p->put_labels = put_labels" assignment, so the tcf_ct_params_free() fallback does not release the count either. Each failed RTM_NEWACTION on these paths leaks one nf_connlabels reference: net->ct.labels_used is incremented and never released. The action is reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged user namespace on default-userns kernels. Impact: an unprivileged user with CAP_NET_ADMIN over a network namespace (e.g. via user namespaces) leaks one nf_connlabels reference per failed RTM_NEWACTION on the two error paths; net->ct.labels_used is never released. The err: label is safe to reach from both sites: p->tmpl is still NULL there (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so no inline release is needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72430

EUVD

EUVD-2026-59329

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a reference leak in the net/sched: act_ct component. When processing network actions, the function tcf_ct_fill_params() acquires a label reference via nf_connlabels_get() but fails to release it properly on two error paths. This happens because the error handling skips the cleanup label (err:) where nf_connlabels_put() should be called. As a result, each failed RTM_NEWACTION operation leaks one nf_connlabels reference, incrementing net->ct.labels_used without releasing it.

Detection Guidance

This vulnerability is specific to the Linux kernel's net/sched act_ct module and involves leaked nf_connlabels references. Detection requires checking kernel logs for failed RTM_NEWACTION operations or monitoring net->ct.labels_used increments. No direct commands are provided in the context, but kernel logs or monitoring tools tracking netfilter connections may reveal anomalies.

Impact Analysis

An unprivileged user with CAP_NET_ADMIN privileges in a network namespace (such as via user namespaces on default-userns kernels) can exploit this flaw. Each failed network action (RTM_NEWACTION) on the affected error paths will leak a reference, gradually consuming kernel resources. Over time, this could lead to resource exhaustion, potentially causing system instability or denial-of-service conditions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a resource leak in the Linux kernel's network subsystem, specifically in the net/sched: act_ct module. The impact is limited to potential denial-of-service conditions due to label reference leaks, not data breaches or privacy violations.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for net/sched: act_ct nf_connlabels leak. Monitor net->ct.labels_used for unexpected increments after patching.

Hi! I’m here to help you understand CVE-2026-72430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70