CVE-2026-43234

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> team: avoid NETDEV_CHANGEMTU event when unregistering slave<br /> <br /> syzbot is reporting<br /> <br /> unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3<br /> ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at<br /> __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]<br /> netdev_hold include/linux/netdevice.h:4429 [inline]<br /> inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286<br /> inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600<br /> notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85<br /> call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]<br /> netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886<br /> netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907<br /> dev_set_mtu+0x126/0x260 net/core/dev_api.c:248<br /> team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333<br /> team_del_slave drivers/net/team/team_core.c:1936 [inline]<br /> team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929<br /> notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85<br /> call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]<br /> call_netdevice_notifiers net/core/dev.c:2295 [inline]<br /> __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592<br /> do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060<br /> rtnl_changelink net/core/rtnetlink.c:3776 [inline]<br /> __rtnl_newlink net/core/rtnetlink.c:3935 [inline]<br /> rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072<br /> rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958<br /> netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550<br /> netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]<br /> netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344<br /> netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894<br /> <br /> problem. Ido Schimmel found steps to reproduce<br /> <br /> ip link add name team1 type team<br /> ip link add name dummy1 mtu 1499 master team1 type dummy<br /> ip netns add ns1<br /> ip link set dev dummy1 netns ns1<br /> ip -n ns1 link del dev dummy1<br /> <br /> and also found that the same issue was fixed in the bond driver in<br /> commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when<br /> unregistering slave").<br /> <br /> Let&amp;#39;s do similar thing for the team driver, with commit ad7c7b2172c3 ("net:<br /> hold netdev instance lock during sysfs operations") and commit 303a8487a657<br /> ("net: s/__dev_set_mtu/__netif_set_mtu/") also applied.