CVE-2026-22994 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the Linux kernel for their systems should be aware of this vulnerability. The vulnerability can cause a reference count leak, leading to system unresponsiveness. Affected operators, platforms, and security teams should review the vulnerability and plan for mitigation.

Technical summary

The vulnerability is caused by a missing call to xdp_convert_buff_to_md() in the error handling path of the bpf_prog_test_run_xdp() function. This can lead to a reference count leak, which can cause the system to become unresponsive. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. It was reported by syzbot and resolved by the Linux kernel maintainers through several commits, including 368569bc546d3368ee9980ba79fc42fdff9a3365, 737be05a765761d7d7c9f7fe92274bd8e6f6951e, 98676ee71fd4eafeb8be63c7f3f1905d40e03101, ec69daabe45256f98ac86c651b8ad1b2574489a7, and fb9ef40cccdbacce36029b305d0ef1e12e4fea38.

Defensive priority

Medium priority

Recommended defensive actions

• Apply the patches provided by the Linux kernel maintainers
• Update the Linux kernel to a version that includes the fix
• Monitor the system for any signs of the vulnerability being exploited
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by syzbot and was resolved by the Linux kernel maintainers. The fix was introduced in several commits, including 368569bc546d3368ee9980ba79fc42fdff9a3365, 737be05a765761d7d7c9f7fe92274bd8e6f6951e, 98676ee71fd4eafeb8be63c7f3f1905d40e03101, ec69daabe45256f98ac86c651b8ad1b2574489a7, and fb9ef40cccdbacce36029b305d0ef1e12e4fea38. The evidence is limited to the provided source corpus and CVE record.

Official resources