CVE-2026-74718
Received Received - Intake

Linux Kernel Net Namespace Reference Leak in devlink reload

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference. Add the missing put_net() on this error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74718
EUVD
EUVD-2026-64405

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a net namespace reference leak in the Linux kernel's devlink component. The issue occurs in the devlink_nl_reload_doit() function, which calls devlink_netns_get() to obtain a network namespace with a held reference. If the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns an error (-EOPNOTSUPP) without releasing the reference, causing a leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's devlink subsystem and involves a net namespace reference leak. Detection requires checking kernel logs for devlink-related errors or warnings, particularly during driver reload operations. Commands like dmesg | grep devlink or journalctl -k | grep devlink may help identify issues. Ensure your kernel version is up-to-date to confirm if the fix is applied.

Impact Analysis

This vulnerability could lead to resource exhaustion in the Linux kernel. A leaked reference may cause the system to run out of available network namespace references, potentially resulting in performance degradation, crashes, or denial of service conditions for network-related operations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, avoid performing devlink driver reload operations in different network namespaces to prevent the reference leak. Monitor kernel logs for any devlink-related errors as a temporary mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74718. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart