CVE-2026-74718

devlink: fix net namespace reference leak in reload

Published Aug 22, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

devlink: fix net namespace reference leak in reload

devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net
with a held reference. When the requested namespace differs from the
current one and the reload action is not DRIVER_REINIT, the function
returns -EOPNOTSUPP without releasing the reference. Add the missing
put_net() on this error path.

Analysis

Technical impact

The vulnerability arises when a devlink reload operation requests a net namespace different from the current one without triggering a driver reinitialization. devlink_nl_reload_doit() obtains a reference to the target net namespace but fails to release it when the operation returns –EOPNOTSUPP. This resource leak (a CWE‑399 Resource Management – Incomplete Release weakness) can accumulate over time, potentially exhausting kernel resources and destabilizing the system. The impact is local and requires privileged access to issue devlink reload commands.

Affected Systems

All Linux kernel builds that include the devlink subsystem are affected, from early stable releases up through the current mainline kernel. No specific sub‑versions are listed, but the issue exists in any kernel that has not yet incorporated the modern fix for this reference leak.

Risk and Exploitability

The EPSS score of <1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the bug occurs during an operation that typically requires root or CAP_SYS_MODULE privileges, the attack vector is local with elevated privileges. An attacker with sufficient permissions could repeatedly trigger the problematic code path, incrementally leaking net namespace references and eventually causing kernel instability, crash, or denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2edd92570441dd33246210042dc167319a5cf7e3`	affected	< 7b6552e53426ea0539c667bbc5a524fdf7feae6f
`2edd92570441dd33246210042dc167319a5cf7e3`	affected	< bf0797b92be591ac71d7c0f610e695caca3c72c9
`2edd92570441dd33246210042dc167319a5cf7e3`	affected	< 7b02c6d2a3cd2cd669f5c16685779f84328ae60c
`2edd92570441dd33246210042dc167319a5cf7e3`	affected	< eda60c85b4f4c7d66b7141a5fe020b1a7f395341
`2edd92570441dd33246210042dc167319a5cf7e3`	affected	< 1c4dac9bf1d2ac31da63b794bdec697777cbd0fd

Linux

affected

Version	Status	Constraints
`6.3`	affected	—
`0`	unaffected	< 6.3
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[2edd92570441dd33246210042dc167319a5cf7e3,7b6552e53426ea0539c667bbc5a524fdf7feae6f)`	affected	code_commit	—
`[2edd92570441dd33246210042dc167319a5cf7e3,bf0797b92be591ac71d7c0f610e695caca3c72c9)`	affected	code_commit	—
`[2edd92570441dd33246210042dc167319a5cf7e3,7b02c6d2a3cd2cd669f5c16685779f84328ae60c)`	affected	code_commit	—
`[2edd92570441dd33246210042dc167319a5cf7e3,eda60c85b4f4c7d66b7141a5fe020b1a7f395341)`	affected	code_commit	—
`[2edd92570441dd33246210042dc167319a5cf7e3,1c4dac9bf1d2ac31da63b794bdec697777cbd0fd)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.3`	affected	generic	—
`[0,6.3)`	unaffected	generic	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a release that includes the reference‑leak fix (e.g., commit 1c4dac9bf1d2ac31da63b794bdec697777cbd0fd)
Reboot or reload networking services to clear any leaked references in the current session
Configure monitoring to detect repeated devlink reload failures, as a sign of a potential exploitation attempt

Generated by OpenCVE AI on August 25, 2026 at 14:14 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.168% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1c4dac9bf1d2ac31da63b794bdec697777cbd0fd
https://git.kernel.org/stable/c/7b02c6d2a3cd2cd669f5c16685779f84328ae60c
https://git.kernel.org/stable/c/7b6552e53426ea0539c667bbc5a524fdf7feae6f
https://git.kernel.org/stable/c/bf0797b92be591ac71d7c0f610e695caca3c72c9
https://git.kernel.org/stable/c/eda60c85b4f4c7d66b7141a5fe020b1a7f395341
https://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74718-49d4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74718
https://www.cve.org/CVERecord?id=CVE-2026-74718

History

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74718-49d4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74718 https://www.cve.org/CVERecord?id=CVE-2026-74718
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Aug 22, 2026 6:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-399 CWE-401

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference. Add the missing put_net() on this error path.
Title		devlink: fix net namespace reference leak in reload
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1c4dac9bf1d2ac31da63b794bdec697777cbd0fd https://git.kernel.org/stable/c/7b02c6d2a3cd2cd669f5c16685779f84328ae60c https://git.kernel.org/stable/c/7b6552e53426ea0539c667bbc5a524fdf7feae6f https://git.kernel.org/stable/c/bf0797b92be591ac71d7c0f610e695caca3c72c9 https://git.kernel.org/stable/c/eda60c85b4f4c7d66b7141a5fe020b1a7f395341