CVE-2026-22994: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22994 is a reference count leak vulnerability in the Linux kernel's BPF subsystem, specifically within the bpf_prog_test_run_xdp() function. The flaw was disclosed on January 23, 2026, and affects Linux kernel versions 5.18 through 6.1.160, 6.2 through 6.6.120, 6.7 through 6.12.65, 6.13 through 6.18.5, and certain 6.19 release candidates (rc1–rc5). It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local, low-privilege attack vector with high availability impact (Red Hat CVE, Feedly).

The root cause is an improper resource management flaw (classified as NVD-CWE-Other) in the error handling path of bpf_prog_test_run_xdp(). When xdp_convert_md_to_buff() acquires a reference count on a network device, the corresponding release function xdp_convert_buff_to_md() must be called to free it. The error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") omitted this call, causing the reference count to leak. This was discovered via syzbot fuzzing, which reported the symptom as unregister_netdevice: waiting for sit0 to become free. Usage count = 2 (Red Hat CVE, Feedly).

Exploitation of this vulnerability results in a denial of service condition on the affected system. Network device references that are not properly released cause devices (such as sit0) to remain stuck with non-zero usage counts, preventing their cleanup and unregistration. This leads to resource exhaustion over time, degrading or halting the system's ability to manage network interfaces. There is no confidentiality or integrity impact; the effect is limited to availability (Feedly).

Patches are available across all affected stable kernel branches. Administrators should update to the following fixed versions or later: 6.1.161 (for 5.18–6.1.x), 6.6.121 (for 6.2–6.6.x), 6.12.66 (for 6.7–6.12.x), or 6.18.6 (for 6.13–6.18.x). The fixes are delivered via kernel.org stable commits: 368569bc546d, 737be05a7657, 98676ee71fd4, ec69daabe452, and fb9ef40cccdb. Downstream distributions including Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1) and Oracle Linux have also released updated packages. No configuration-based workaround is available; patching is the only remediation (Feedly, Ubuntu USN-8278-1).

The vulnerability was initially identified by syzbot, Google's automated kernel fuzzing infrastructure, and reported to the kernel community. Red Hat tracked the issue via Bugzilla (bug #2432396) and assigned it a Medium severity rating. No notable independent researcher commentary or significant media coverage beyond standard vulnerability aggregator reporting has been observed (Red Hat CVE, Feedly).