CVE-2026-90077: net: fix a resource leak in copy_net_ns() error handling path

CVE-2026-90077: net: fix a resource leak in copy_net_ns() error handling path

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: fix a resource leak in copy_net_ns() error handling path

Currently, preinit_net() does two things:

  (1) call ns_common_init() which might fail
  (2) initialize resources which does not fail

However, preinit_net() is returning early when (1) fails, and copy_net_ns()
is jumping to the dec_ucounts: label. As a result, resources allocated by
net_alloc() are leaking. We need to call key_remove_domain() and
net_passive_dec() in order to release resources allocated by net_alloc().

We cannot simply jump to the put_userns: label when preinit_net() failed,
for (2) is not yet done. But we can reorder (1) and (2), for there is no
dependency between (1) and (2). Therefore, this patch decouples (1) from
preinit_net() and changes preinit_net() back to a void function, and calls
ns_common_init() after preinit_net() succeeded. Then, we can jump to
immediately after ns_common_free() of the put_userns: label.

The Linux kernel CVE team has assigned CVE-2026-90077 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.18 with commit 08027f6b790be1e444e4182fb4dc53faa6539d16 and fixed in 6.18.52 with commit 76c847e80d2b6be047707d58e8e05eedbe2593ad
	Issue introduced in 6.18 with commit 08027f6b790be1e444e4182fb4dc53faa6539d16 and fixed in 7.2.6 with commit e69bde4eb566aea8fa97cbb93e0bab608964f1a5
	Issue introduced in 6.18 with commit 08027f6b790be1e444e4182fb4dc53faa6539d16 and fixed in 7.3-rc1 with commit 3220b62fbb8a55feebd2a826d5ead0f49f09ed5a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90077
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/net_namespace.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/76c847e80d2b6be047707d58e8e05eedbe2593ad
	https://git.kernel.org/stable/c/e69bde4eb566aea8fa97cbb93e0bab608964f1a5
	https://git.kernel.org/stable/c/3220b62fbb8a55feebd2a826d5ead0f49f09ed5a