CVE-2026-23192

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> linkwatch: use __dev_put() in callers to prevent UAF<br /> <br /> After linkwatch_do_dev() calls __dev_put() to release the linkwatch<br /> reference, the device refcount may drop to 1. At this point,<br /> netdev_run_todo() can proceed (since linkwatch_sync_dev() sees an<br /> empty list and returns without blocking), wait for the refcount to<br /> become 1 via netdev_wait_allrefs_any(), and then free the device<br /> via kobject_put().<br /> <br /> This creates a use-after-free when __linkwatch_run_queue() tries to<br /> call netdev_unlock_ops() on the already-freed device.<br /> <br /> Note that adding netdev_lock_ops()/netdev_unlock_ops() pair in<br /> netdev_run_todo() before kobject_put() would not work, because<br /> netdev_lock_ops() is conditional - it only locks when<br /> netdev_need_ops_lock() returns true. If the device doesn&amp;#39;t require<br /> ops_lock, linkwatch won&amp;#39;t hold any lock, and netdev_run_todo()<br /> acquiring the lock won&amp;#39;t provide synchronization.<br /> <br /> Fix this by moving __dev_put() from linkwatch_do_dev() to its<br /> callers. The device reference logically pairs with de-listing the<br /> device, so it&amp;#39;s reasonable for the caller that did the de-listing<br /> to release it. This allows placing __dev_put() after all device<br /> accesses are complete, preventing UAF.<br /> <br /> The bug can be reproduced by adding mdelay(2000) after<br /> linkwatch_do_dev() in __linkwatch_run_queue(), then running:<br /> <br /> ip tuntap add mode tun name tun_test<br /> ip link set tun_test up<br /> ip link set tun_test carrier off<br /> ip link set tun_test carrier on<br /> sleep 0.5<br /> ip tuntap del mode tun name tun_test<br /> <br /> KASAN report:<br /> <br /> ==================================================================<br /> BUG: KASAN: use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]<br /> BUG: KASAN: use-after-free in netdev_unlock_ops include/net/netdev_lock.h:47 [inline]<br /> BUG: KASAN: use-after-free in __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245<br /> Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123<br /> <br /> CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full)<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014<br /> Workqueue: events_unbound linkwatch_event<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:94 [inline]<br /> dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120<br /> print_address_description mm/kasan/report.c:378 [inline]<br /> print_report+0x156/0x4c9 mm/kasan/report.c:482<br /> kasan_report+0xdf/0x1a0 mm/kasan/report.c:595<br /> netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]<br /> netdev_unlock_ops include/net/netdev_lock.h:47 [inline]<br /> __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245<br /> linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304<br /> process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257<br /> process_scheduled_works kernel/workqueue.c:3340 [inline]<br /> worker_thread+0x5da/0xe40 kernel/workqueue.c:3421<br /> kthread+0x3b3/0x730 kernel/kthread.c:463<br /> ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158<br /> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246<br /> <br /> ==================================================================