AZL-97341

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix netns reference imbalance in conntrack kfuncs

The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpfnfct_lookup() and _bpfnfctallocentry() read opts->netnsid separately when acquiring and releasing the network namespace reference.

The reference imbalance can occur as follows:

CPU 0 CPU 1 read opts->netnsid (-1) skip getnetnsbyid() write opts->netnsid (id) read opts->netnsid (id) putnet(net) /* no matching get */

The reverse transition leaks the reference. Repeating the unmatched put can destroy a live namespace and crash later users.

The kernel reported:

Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] RIP: 0010:bpfprogtestrunxdp+0x52c/0x1700 Call Trace: __sys_bpf+0x1662/0x50c0 __x64sysbpf+0x73/0xb0 dosyscall64+0xf9/0x540 entrySYSCALL64afterhwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception

Snapshot every input field of opts with READONCE() before validating or using it. The netnsid snapshot keeps the namespace get/put pair balanced, while the other snapshots keep the remaining options from changing partway through an invocation. The individual reads can still observe an inconsistent combination during a concurrent update, but each selected field value remains stable for that invocation.