CVE-2026-72430

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the Linux kernel within the tcf ct fill params() function. When TCA CT LABELS is present, the function calls nf connlabels get(), but two error paths utilize a bare return instead of directing the flow to the cleanup label. This bypasses the nf connlabels put() cleanup and occurs before the put labels assignment, preventing the tcf ct params free() fallback from releasing the count. Consequently, each failed RTM NEWACTION on these paths leaks one nf connlabels reference, causing net->ct.labels used to increment without being released. This issue is reachable by an unprivileged user with CAP NET ADMIN privileges over a network namespace, such as through user namespaces on default-userns kernels.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.