CVE-2026-72430
net/sched: act_ct: fix nf_connlabels leak on two error paths
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix nf_connlabels leak on two error paths tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when TCA_CT_LABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err: nf_connlabels_put() cleanup. They also precede the "p->put_labels = put_labels" assignment, so the tcf_ct_params_free() fallback does not release the count either. Each failed RTM_NEWACTION on these paths leaks one nf_connlabels reference: net->ct.labels_used is incremented and never released. The action is reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged user namespace on default-userns kernels. Impact: an unprivileged user with CAP_NET_ADMIN over a network namespace (e.g. via user namespaces) leaks one nf_connlabels reference per failed RTM_NEWACTION on the two error paths; net->ct.labels_used is never released. The err: label is safe to reach from both sites: p->tmpl is still NULL there (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so no inline release is needed.
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 17, 2026, 6:19 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to the patched version.
- Rebuild and deploy the updated kernel.
- Restart affected systems.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72430.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72430 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72430
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72430 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72430 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '13b561c893c741635adce3781490a7a1099106c8', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '1d51aff78f078af1a80e9496c2f4643f4c0ef0a0', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '16e088016f38cf728a0de709c3335cc5a3850476', 'versionType': 'git'}], 'programFiles': ['net/sched/act_ct.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sched/act_ct.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '13b561c893c741635adce3781490a7a1099106c8', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '1d51aff78f078af1a80e9496c2f4643f4c0ef0a0', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '16e088016f38cf728a0de709c3335cc5a3850476', 'versionType': 'git'}], 'programFiles': ['net/sched/act_ct.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sched/act_ct.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '13b561c893c741635adce3781490a7a1099106c8', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '1d51aff78f078af1a80e9496c2f4643f4c0ef0a0', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4', 'versionType': 'git'}, {'status': 'affected', 'version': '70f06c115bcca26ceeebf938e48bc8143668e38b', 'lessThan': '16e088016f38cf728a0de709c3335cc5a3850476', 'versionType': 'git'}], 'programFiles': ['net/sched/act_ct.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sched/act_ct.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix nf_connlabels leak on two error paths tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when TCA_CT_LABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err: nf_connlabels_put() cleanup. They also precede the "p->put_labels = put_labels" assignment, so the tcf_ct_params_free() fallback does not release the count either. Each failed RTM_NEWACTION on these paths leaks one nf_connlabels reference: net->ct.labels_used is incremented and never released. The action is reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged user namespace on default-userns kernels. Impact: an unprivileged user with CAP_NET_ADMIN over a network namespace (e.g. via user namespaces) leaks one nf_connlabels reference per failed RTM_NEWACTION on the two error paths; net->ct.labels_used is never released. The err: label is safe to reach from both sites: p->tmpl is still NULL there (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so no inline release is needed. Added Reference https://git.kernel.org/stable/c/0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4 Added Reference https://git.kernel.org/stable/c/13b561c893c741635adce3781490a7a1099106c8 Added Reference https://git.kernel.org/stable/c/16e088016f38cf728a0de709c3335cc5a3850476 Added Reference https://git.kernel.org/stable/c/1d51aff78f078af1a80e9496c2f4643f4c0ef0a0