Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem that could lead to system instability or crashes. The issue occurs when the system attempts to display information about network packet types while network devices are simultaneously being modified or removed. This could allow a local user to trigger a system hang or 'RCU stall,' potentially disrupting services or causing a complete system reboot.
Technical details
A race condition exists in net/core/net-procfs.c within the ptype_seq_next() and ptype_seq_show() functions. The vulnerability stems from a violation of RCU rules where ptype_seq_show() reads pt->dev without proper barriers or READ_ONCE() calls while concurrent writers remove packet_type structures. This lack of synchronization can lead to RCU stalls when the kernel attempts to iterate through packet type registrations. The fix introduces a ptype_iter_state structure to safely carry the device pointer and adds necessary READ_ONCE() macros to ensure memory visibility during list traversal. Patch availability is confirmed across multiple stable kernel branches including 6.12.y, 6.6.y, and others.
Affected products
- Linux Linux kernel 6.13 to 6.18.10, 6.7 to 6.12.80, 2.6.12.1 to 6.6.136
Timeline
- 2026-03-18: advisory: Initial disclosure and NVD publication
- 2026-04-27: patched: Fix committed to stable kernel trees