{"id":"CVE-2026-64424","state":"PUBLISHED","title":"netpoll: fix a use-after-free on shutdown path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: fix a use-after-free on shutdown path\n\nThere is a use-after-free error on netpoll, which is clearly detected by\nKASAN.\n\n      BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3b/0x80\n      Read of size 1 at addr ... by task kworker/9:1\n      Workqueue: events queue_process\n      Call Trace:\n       skb_dequeue+0x1e/0xb0\n       queue_process+0x2c/0x600\n       process_scheduled_works+0x4b6/0x850\n       worker_thread+0x414/0x5a0\n      Allocated by task 242:\n       __netpoll_setup+0x201/0x4a0\n       netpoll_setup+0x249/0x550\n       enabled_store+0x32f/0x380\n      Freed by task 0:\n       kfree+0x1b7/0x540\n       rcu_core+0x3f8/0x7a0\n\nThe problem happens when there is a pending TX worker running in\nparallel with the cleanup path.\n\nThis is what happens on netpoll shutdown path:\n\n1) __netpoll_cleanup() is called\n2) set dev->npinfo to NULL\n3) call_rcu() with rcu_cleanup_netpoll_info()\n  3.1) rcu_cleanup_netpoll_info() tries to cancel all workers with\n       cancel_delayed_work(), but doesn't wait for the worker to finish\n4) and kfree(npinfo);\n\nBecause 3.1) doesn't really cancel the work, as the comment says \"we\ncan't call cancel_delayed_work_sync here, as we are in softirq\", the TX\nworker can run after 4).\n\nTl;DR: queue_process() is not an RCU reader, it reaches npinfo through\nthe work item via container_of().\n\nUse disable_delayed_work_sync() to ensure the worker is completely\nstopped and prevent any future re-arming attempts. Once npinfo is set\nto NULL, senders will bail out and not queue new work. The disable flag\nensures any in-flight re-arming attempts also fail silently.\n\nIn the future, we can do the cleanup inline here without needing the\nnpinfo->rcu rcu_head, but that is net-next material.","publishedAt":"2026-07-25T08:51:02.276Z","updatedAt":"2026-10-30T12:27:54.711Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"b67625b85c4b1a3725f4be9c6dd8ce3399d11732","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"95ecc5b58042f6b6743b589e6588f1cd7ba336aa","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"5ed09a108d93a3b002cc79823d9455b50c4a8be7","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"45f1458a85017a023f138b22ac5c76abd477db42","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/netpoll.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.6","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/netpoll.c"]}],"references":["https://git.kernel.org/stable/c/b67625b85c4b1a3725f4be9c6dd8ce3399d11732","https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa","https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf","https://git.kernel.org/stable/c/5ed09a108d93a3b002cc79823d9455b50c4a8be7","https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"],"weaknesses":[],"ingestedAt":"2026-10-30T12:46:06.359Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64424.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64424","state":"PUBLISHED","datePublished":"2026-07-25T08:51:02.276Z","dateUpdated":"2026-10-30T12:27:54.711Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.787Z"},"containers":{"cna":{"title":"netpoll: fix a use-after-free on shutdown path","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: fix a use-after-free on shutdown path\n\nThere is a use-after-free error on netpoll, which is clearly detected by\nKASAN.\n\n      BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3b/0x80\n      Read of size 1 at addr ... by task kworker/9:1\n      Workqueue: events queue_process\n      Call Trace:\n       skb_dequeue+0x1e/0xb0\n       queue_process+0x2c/0x600\n       process_scheduled_works+0x4b6/0x850\n       worker_thread+0x414/0x5a0\n      Allocated by task 242:\n       __netpoll_setup+0x201/0x4a0\n       netpoll_setup+0x249/0x550\n       enabled_store+0x32f/0x380\n      Freed by task 0:\n       kfree+0x1b7/0x540\n       rcu_core+0x3f8/0x7a0\n\nThe problem happens when there is a pending TX worker running in\nparallel with the cleanup path.\n\nThis is what happens on netpoll shutdown path:\n\n1) __netpoll_cleanup() is called\n2) set dev->npinfo to NULL\n3) call_rcu() with rcu_cleanup_netpoll_info()\n  3.1) rcu_cleanup_netpoll_info() tries to cancel all workers with\n       cancel_delayed_work(), but doesn't wait for the worker to finish\n4) and kfree(npinfo);\n\nBecause 3.1) doesn't really cancel the work, as the comment says \"we\ncan't call cancel_delayed_work_sync here, as we are in softirq\", the TX\nworker can run after 4).\n\nTl;DR: queue_process() is not an RCU reader, it reaches npinfo through\nthe work item via container_of().\n\nUse disable_delayed_work_sync() to ensure the worker is completely\nstopped and prevent any future re-arming attempts. Once npinfo is set\nto NULL, senders will bail out and not queue new work. The disable flag\nensures any in-flight re-arming attempts also fail silently.\n\nIn the future, we can do the cleanup inline here without needing the\nnpinfo->rcu rcu_head, but that is net-next material."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"b67625b85c4b1a3725f4be9c6dd8ce3399d11732","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"95ecc5b58042f6b6743b589e6588f1cd7ba336aa","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"5ed09a108d93a3b002cc79823d9455b50c4a8be7","versionType":"git"},{"version":"38e6bc185d9544dfad1774b3f8902a0b061aea25","status":"affected","lessThan":"45f1458a85017a023f138b22ac5c76abd477db42","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/netpoll.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.6","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/netpoll.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b67625b85c4b1a3725f4be9c6dd8ce3399d11732"},{"url":"https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa"},{"url":"https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf"},{"url":"https://git.kernel.org/stable/c/5ed09a108d93a3b002cc79823d9455b50c4a8be7"},{"url":"https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:27:54.711Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.12.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.18.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}