{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72430","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.928Z","datePublished":"2026-08-15T05:56:46.178Z","dateUpdated":"2026-08-17T05:14:29.962Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:14:29.962Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix nf_connlabels leak on two error paths\n\ntcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when\nTCA_CT_LABELS is present, but two later error sites use a bare return\ninstead of \"goto err\", skipping the err: nf_connlabels_put() cleanup.\nThey also precede the \"p->put_labels = put_labels\" assignment, so the\ntcf_ct_params_free() fallback does not release the count either. Each\nfailed RTM_NEWACTION on these paths leaks one nf_connlabels reference:\nnet->ct.labels_used is incremented and never released. The action is\nreachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged\nuser namespace on default-userns kernels.\n\nImpact: an unprivileged user with CAP_NET_ADMIN over a network namespace\n(e.g. via user namespaces) leaks one nf_connlabels reference per failed\nRTM_NEWACTION on the two error paths; net->ct.labels_used is never\nreleased.\n\nThe err: label is safe to reach from both sites: p->tmpl is still NULL\nthere (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so\nno inline release is needed."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/act_ct.c"],"versions":[{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","lessThan":"13b561c893c741635adce3781490a7a1099106c8","status":"affected","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","lessThan":"1d51aff78f078af1a80e9496c2f4643f4c0ef0a0","status":"affected","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","lessThan":"0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4","status":"affected","versionType":"git"},{"version":"70f06c115bcca26ceeebf938e48bc8143668e38b","lessThan":"16e088016f38cf728a0de709c3335cc5a3850476","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/act_ct.c"],"versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/13b561c893c741635adce3781490a7a1099106c8"},{"url":"https://git.kernel.org/stable/c/1d51aff78f078af1a80e9496c2f4643f4c0ef0a0"},{"url":"https://git.kernel.org/stable/c/0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4"},{"url":"https://git.kernel.org/stable/c/16e088016f38cf728a0de709c3335cc5a3850476"}],"title":"net/sched: act_ct: fix nf_connlabels leak on two error paths","x_generator":{"engine":"bippy-1.2.0"}}}}