CVE-2026-46047

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: qrtr: ns: Fix use-after-free in driver remove()<br /> <br /> In the remove callback, if a packet arrives after destroy_workqueue() is<br /> called, but before sock_release(), the qrtr_ns_data_ready() callback will<br /> try to queue the work, causing use-after-free issue.<br /> <br /> Fix this issue by saving the default &amp;#39;sk_data_ready&amp;#39; callback during<br /> qrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at<br /> the start of remove(). This ensures that even if a packet arrives after<br /> destroy_workqueue(), the work struct will not be dereferenced.<br /> <br /> Note that it is also required to ensure that the RX threads are completed<br /> before destroying the workqueue, because the threads could be using the<br /> qrtr_ns_data_ready() callback.