In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink_nl_reload_doit()… (CVE-2026-74718)
A vulnerability in the Linux kernel's devlink component caused a net namespace reference leak in the reload function devlink_nl_reload_doit(). Specifically, when the requested network namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns an error without releasing a held reference, leading to a resource leak. This issue has been resolved by adding the missing put_net() call on the error path.
AI Analysis
Technical Summary
The Linux kernel devlink component had a flaw in the devlink_nl_reload_doit() function where devlink_netns_get() returns a network namespace with a held reference. If the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returned -EOPNOTSUPP without releasing the reference, causing a net namespace reference leak. The fix involves adding the missing put_net() call to properly release the reference on this error path.
Potential Impact
This vulnerability results in a net namespace reference leak, which could lead to resource exhaustion or degraded system performance over time. There is no indication of direct security compromise such as privilege escalation or code execution from the provided data.
Mitigation Recommendations
A fix has been implemented to address this issue by adding the missing put_net() call. Since the vulnerability is resolved, applying the official Linux kernel update that includes this fix is recommended. Patch status is not explicitly confirmed in the data; therefore, check the vendor advisory for the current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink_nl_reload_doit()… (CVE-2026-74718)
Description
A vulnerability in the Linux kernel's devlink component caused a net namespace reference leak in the reload function devlink_nl_reload_doit(). Specifically, when the requested network namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns an error without releasing a held reference, leading to a resource leak. This issue has been resolved by adding the missing put_net() call on the error path.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel devlink component had a flaw in the devlink_nl_reload_doit() function where devlink_netns_get() returns a network namespace with a held reference. If the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returned -EOPNOTSUPP without releasing the reference, causing a net namespace reference leak. The fix involves adding the missing put_net() call to properly release the reference on this error path.
Potential Impact
This vulnerability results in a net namespace reference leak, which could lead to resource exhaustion or degraded system performance over time. There is no indication of direct security compromise such as privilege escalation or code execution from the provided data.
Mitigation Recommendations
A fix has been implemented to address this issue by adding the missing put_net() call. Since the vulnerability is resolved, applying the official Linux kernel update that includes this fix is recommended. Patch status is not explicitly confirmed in the data; therefore, check the vendor advisory for the current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-67hf-fh94-4rj7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74718"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f0acd9273b499bc6fc
Added to database: 08/22/2026, 22:51:28 UTC
Last enriched: 08/23/2026, 00:39:39 UTC
Last updated: 08/23/2026, 02:32:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.