Medium 5.5Published Jan 23, 2026

CVE-2026-22994bpf: Fix reference count leak in bpf_prog_test_run_xdp()

Updated under an hour ago (Oct 27, 2026, 9:00 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdp_md context in BPF_PROG_TEST_RUN"), the refcount obtained by xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") forgot to call xdp_convert_buff_to_md().

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1c194998252469cad00a08bd9ef0b99fd255c260 before 368569bc546d3368ee9980ba79fc42fdff9a3365; from 1c194998252469cad00a08bd9ef0b99fd255c260 before 98676ee71fd4eafeb8be63c7f3f1905d40e03101; from 1c194998252469cad00a08bd9ef0b99fd255c260 before fb9ef40cccdbacce36029b305d0ef1e12e4fea38; from 1c194998252469cad00a08bd9ef0b99fd255c260 before 737be05a765761d7d7c9f7fe92274bd8e6f6951e; from 1c194998252469cad00a08bd9ef0b99fd255c260 before ec69daabe45256f98ac86c651b8ad1b2574489a7	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.18 before 6.1.161; from 6.2 before 6.6.121; from 6.7 before 6.12.66; from 6.13 before 6.18.6; 6.19; 6.19; 6.19; 6.19; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/368569bc546d3368ee9980ba79fc42fdff9a3365	patch
https://git.kernel.org/stable/c/98676ee71fd4eafeb8be63c7f3f1905d40e03101	patch
https://git.kernel.org/stable/c/fb9ef40cccdbacce36029b305d0ef1e12e4fea38	patch
https://git.kernel.org/stable/c/737be05a765761d7d7c9f7fe92274bd8e6f6951e	patch
https://git.kernel.org/stable/c/ec69daabe45256f98ac86c651b8ad1b2574489a7	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.