Executive brief
The Linux kernel's network device initialization code contains a use-after-free vulnerability in the refcount tracking subsystem. When network device allocation fails partway through setup, the tracking directory is not properly cleaned up, allowing subsequent access through a debug interface to crash the system. This affects any process attempting to read diagnostic kernel data if a device allocation has previously failed.
Technical details
The vulnerability is a use-after-free in the net device initialization path (alloc_netdev_mqs() in net/core/dev.c). The refcount tracker directory is initialized early in device allocation but only cleaned up in the free_netdev() path. When allocation fails partway through (e.g., alloc_percpu() or dev_addr_init() failure), ref_tracker_dir_exit() is not called, leaving a dangling directory entry. A local user reading /sys/kernel/debug/ref_tracker/* afterward triggers a crash. The fix adds ref_tracker_dir_exit() to the error path. The vulnerability requires local file system access to the debugfs interface and is triggered passively by reading debug information after a prior failed allocation attempt.
Affected products
- Linux Linux kernel Affected versions from commit 4d92b95ff2f9 onwards; patched in mainline commit 0b1c2af8a22c35cb099c735c2f63ea3ba757557d (2026-08-18)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-08-18: patched: Mainline fix committed by Jakub Kicinski
- 2026-09-14: patched: Fix included in stable kernels via Sasha Levin