CVE-2026-72430

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix nf_connlabels leak on two error paths

tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when

TCA_CT_LABELS is present, but two later error sites use a bare return

instead of "goto err", skipping the err: nf_connlabels_put() cleanup.

They also precede the "p->put_labels = put_labels" assignment, so the

tcf_ct_params_free() fallback does not release the count either. Each

failed RTM_NEWACTION on these paths leaks one nf_connlabels reference:

net->ct.labels_used is incremented and never released. The action is

reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged

user namespace on default-userns kernels.

Impact: an unprivileged user with CAP_NET_ADMIN over a network namespace

(e.g. via user namespaces) leaks one nf_connlabels reference per failed

RTM_NEWACTION on the two error paths; net->ct.labels_used is never

released.

The err: label is safe to reach from bo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References