Executive brief
The Linux kernel's netdevsim (network device simulator) module contains a use-after-free vulnerability in its queue reset mechanism. When network receive queues are reset, the kernel fails to properly update internal data structure pointers, causing the system to reference freed memory when querying queue information via Netlink. This can lead to kernel crashes or data corruption.
Technical details
The vulnerability is a use-after-free in the netdevsim driver's queue management code. When nsim_queue_start() allocates a new receive queue (struct nsim_rq), it fails to call netif_queue_set_napi() to update the queue-to-NAPI mapping in dev->_rx[idx].napi. After the old queue is freed, a subsequent Netlink queue dump (NETDEV_CMD_QUEUE_GET) triggers a KASAN slab-use-after-free read in nla_put_napi_id() when accessing the stale napi->napi_id pointer. The fix requires calling netif_queue_set_napi() to associate the new NAPI with the RX queue during queue start and clearing the association during teardown. No authentication is required; a local user with appropriate capabilities can trigger the vulnerability via the queue_reset debugfs interface or Netlink.
Affected products
- Linux Linux kernel 5.14 and later (netdevsim driver)
Timeline
- 2026-09-17: disclosed
- 2026-08-20: patched