CVE-2026-74715

BPF conntrack kfuncs can read opts netns_id more than once while opts points to a shared BPF map value that can be modified concurrently. A racing update can make the function skip get_net_ns_by_id but later execute put_net, or can make the reverse transition leak a namespace reference. The unmatched put can destroy a live network namespace and later users may dereference invalid namespace state, causing a kernel crash and creating a plausible use-after-free lifetime hazard. For the CVSS the PR:L is selected because a local user or service with BPF related privileges is needed to load or run the affected BPF program and update the shared map value. The issue is not directly network reachable, although packet processing may exercise the already loaded BPF program. Impact is at least local denial of service via kernel panic, and the paranoid score treats the namespace lifetime corruption as a potential confidentiality and integrity risk that should be reviewed manually.