CVE-2026-74662

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> inet: frags: publish queues before arming timer<br /> <br /> inet_frag_create() arms the fragment queue timer before inserting the<br /> queue into the fqdir rhashtable. If the namespace fragment timeout is<br /> zero or negative, the timer can run before the queue is published.<br /> <br /> The timer callback then marks the queue complete, tries to remove a node<br /> that is not in the hash table yet, and drops the anticipated hash<br /> reference. Creation can subsequently publish the completed queue without<br /> restoring that reference, leaving a stale hash node after the caller drops<br /> the remaining reference.<br /> <br /> Publish the queue first and arm the timer while holding the queue lock.<br /> This makes timer expiry wait until the queue is visible in the hash table,<br /> so inet_frag_kill() can remove the node and balance the hash reference.