SB20260815298 - Improper resource shutdown or release in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-72430)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in tcf_ct_fill_params() in net/sched/act_ct.c when handling failed RTM_NEWACTION requests with TCA_CT_LABELS present on certain error paths. A local user can send a crafted RTM_NEWACTION request to cause a resource leak.

Exploitation requires CAP_NET_ADMIN over a network namespace and is reachable from an unprivileged user namespace on default-userns kernels.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0c3d8fc87e10e38fe054ece009d6d1f66bef2cd4
• https://git.kernel.org/stable/c/13b561c893c741635adce3781490a7a1099106c8
• https://git.kernel.org/stable/c/16e088016f38cf728a0de709c3335cc5a3850476
• https://git.kernel.org/stable/c/1d51aff78f078af1a80e9496c2f4643f4c0ef0a0