Executive brief
A vulnerability was identified in the Linux kernel's netpoll subsystem, which is used for sending network packets in critical situations like kernel debugging or logging. A race condition during the shutdown process could allow a background task to access memory after it has been deleted. This could lead to system instability, crashes, or potentially unauthorized access to system memory.
Technical details
A use-after-free vulnerability exists in net/core/netpoll.c within the Linux kernel. The issue stems from a race condition in __netpoll_cleanup() where the shutdown path sets dev->npinfo to NULL and schedules rcu_cleanup_netpoll_info() to free the structure. However, the cleanup routine uses cancel_delayed_work() instead of a synchronous wait, allowing a pending TX worker (queue_process) to execute after the memory has been freed via kfree(npinfo). An attacker with local access could potentially exploit this race condition to cause a kernel panic or achieve arbitrary code execution. The fix involves using disable_delayed_work_sync() to ensure all workers are stopped before the memory is released.
Affected products
- Linux Linux Kernel 38e6bc185d95 to 45f1458a8501
Timeline
- 2026-06-25: disclosed: Initial patch submission by Breno Leitao
- 2026-07-25: advisory: CVE-2026-64424 published