HIGH Introduced in 5.17
netdev RefTracker UAF
CVE-2026-90135
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() sashiko is reporting that trying to read /sys/kernel/debug/ref_tracker/* causes use-afer-free crash when either alloc_percpu() or dev_addr_init() in alloc_netdev_mqs() failed, for commit 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") added ref_tracker_dir_exit() to only free_netdev() path.
02KernelScan AI Analysis
Risk summary
A use-after-free occurs in the net device refcount tracker infrastructure when network device allocation fails partway through. An attacker who can trigger or influence allocation failure paths can cause a kernel crash by reading ref_tracker debugfs entries.
Vulnerability analysis
When a network device is allocated and a later initialization step fails, the error path frees the device structure without first cleaning up the refcount tracker directory that was already initialized. If someone then reads the ref_tracker debugfs entries, the kernel dereferences the already-freed tracker, causing a use-after-free crash. The fix adds the missing cleanup call to the error path so the tracker is properly torn down before the device is freed. This is reachable by any local user who can trigger device allocation failure paths and then read the debugfs ref_tracker files, which requires the CONFIG_NET_DEV_REFCNT_TRACKER option to be enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 5.17 | 7.3-rc1 | 0b1c2af8a22c |
| 6.12 | 5.17 | 6.12.110 | 2775bf36be78 |
| 6.18 | 5.17 | 6.18.52 | 5fe03b525709 |
| 7.2 | 5.17 | 7.2.6 | 63ab05e8f965 |
| cip/6.12 | 5.17 | 6.12.111-cip32 | 2775bf36be78 |