CVE-2026-72430

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix nf_connlabels leak on two error paths

tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when

TCA_CT_LABELS is present, but two later error sites use a bare return

instead of "goto err", skipping the err: nf_connlabels_put() cleanup.

They also precede the "p->put_labels = put_labels" assignment, so the

tcf_ct_params_free() fallback does not release the count either. Each

failed RTM_NEWACTION on these paths leaks one nf_connlabels reference:

net->ct.labels_used is incremented and never released. The action is

reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged

user namespace on default-userns kernels.

Impact: an unprivileged user with CAP_NET_ADMIN over a network namespace

(e.g. via user namespaces) leaks one nf_connlabels reference per failed

RTM_NEWACTION on the two error paths; net->ct.labels_used is never

released.

The err: label is safe to reach from both sites: p->tmpl is still NULL

there (kzalloc'd, not yet assigned) and nf_ct_put(NULL) is a no-op, so

no inline release is needed.