CVE-2026-22994
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdp_md context in BPF_PROG_TEST_RUN"), the refcount obtained by xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") forgot to call xdp_convert_buff_to_md().
How to fix
- linux linux_kernel6.1.161, 6.6.121, 6.12.66, 6.18.6 or later
- git.kernel.org/stable/c/368569bc546d3368ee9980ba79fc42fdff9a3365
- git.kernel.org/stable/c/737be05a765761d7d7c9f7fe92274bd8e6f6951e
- git.kernel.org/stable/c/98676ee71fd4eafeb8be63c7f3f1905d40e03101
- git.kernel.org/stable/c/ec69daabe45256f98ac86c651b8ad1b2574489a7
- git.kernel.org/stable/c/fb9ef40cccdbacce36029b305d0ef1e12e4fea38
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.18 ≤ v < 6.1.161, 6.2 ≤ v < 6.6.121, 6.7 ≤ v < 6.12.66, 6.13 ≤ v < 6.18.6, 6.19 | 6.1.161, 6.6.121, 6.12.66, 6.18.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.