Home

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdp_md context in BPF_PROG_TEST_RUN"), the refcount obtained by xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") forgot to call xdp_convert_buff_to_md().

PUBLISHED Reserved 2026-01-13 | Published 2026-01-23 | Updated 2026-01-23 | Assigner Linux

Product status

Default status
unaffected

1c194998252469cad00a08bd9ef0b99fd255c260 (git) before 368569bc546d3368ee9980ba79fc42fdff9a3365
affected

1c194998252469cad00a08bd9ef0b99fd255c260 (git) before 98676ee71fd4eafeb8be63c7f3f1905d40e03101
affected

1c194998252469cad00a08bd9ef0b99fd255c260 (git) before fb9ef40cccdbacce36029b305d0ef1e12e4fea38
affected

1c194998252469cad00a08bd9ef0b99fd255c260 (git) before 737be05a765761d7d7c9f7fe92274bd8e6f6951e
affected

1c194998252469cad00a08bd9ef0b99fd255c260 (git) before ec69daabe45256f98ac86c651b8ad1b2574489a7
affected

Default status
affected

5.18
affected

Any version before 5.18
unaffected

6.1.161 (semver)
unaffected

6.6.121 (semver)
unaffected

6.12.66 (semver)
unaffected

6.18.6 (semver)
unaffected

6.19-rc6 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/368569bc546d3368ee9980ba79fc42fdff9a3365

git.kernel.org/...c/98676ee71fd4eafeb8be63c7f3f1905d40e03101

git.kernel.org/...c/fb9ef40cccdbacce36029b305d0ef1e12e4fea38

git.kernel.org/...c/737be05a765761d7d7c9f7fe92274bd8e6f6951e

git.kernel.org/...c/ec69daabe45256f98ac86c651b8ad1b2574489a7

cve.org (CVE-2026-22994)

nvd.nist.gov (CVE-2026-22994)

Download JSON