{"id":"CVE-2026-74264","state":"PUBLISHED","title":"net: watchdog: fix refcount tracking races","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: watchdog: fix refcount tracking races\n\nBlamed commit converted the untracked dev_hold()/dev_put() calls\nin the watchdog code to use the tracked dev_hold_track()/dev_put_track()\n(which were later renamed/interfaced to netdev_hold() and netdev_put()).\n\nBy introducing dev->watchdog_dev_tracker to store the\nreference tracking information without adding synchronization\nbetween netdev_watchdog_up() and dev_watchdog(), it enabled the\nrace condition where this pointer could be overwritten or freed\nconcurrently, leading to the list corruption crash syzbot reported:\n\nlist_del corruption, ffff888114a18c00->next is NULL\n kernel BUG at lib/list_debug.c:52 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026\nWorkqueue: events_unbound linkwatch_event\n RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52\nCall Trace:\n <TASK>\n  __list_del_entry_valid include/linux/list.h:132 [inline]\n  __list_del_entry include/linux/list.h:246 [inline]\n  list_move_tail include/linux/list.h:341 [inline]\n  ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329\n  netdev_tracker_free include/linux/netdevice.h:4491 [inline]\n  netdev_put include/linux/netdevice.h:4508 [inline]\n  netdev_put include/linux/netdevice.h:4504 [inline]\n  netdev_watchdog_down net/sched/sch_generic.c:600 [inline]\n  dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363\n  dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397\n  linkwatch_do_dev net/core/link_watch.c:184 [inline]\n  linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166\n  __linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240\n  linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314\n  process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314\n  process_scheduled_works kernel/workqueue.c:3397 [inline]\n  worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478\n  kthread+0x370/0x450 kernel/kthread.c:436\n  ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nThis patch has three coordinated parts:\n\n1) Add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations.\n\n2) Remove netdev_watchdog_up() call from netif_carrier_on():\n   This ensures netdev_watchdog_up() is only called from process/BH context\n   (via linkwatch workqueue dev_activate()), allowing us to use\n   spin_lock_bh() for synchronization.\n\n3) Synchronize watchdog up and watchdog timer:\n   Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.\n   Only allocate a new tracker in netdev_watchdog_up() if one is\n   not already present.\n   In dev_watchdog(), ensure we don't release the tracker if the\n   timer was rescheduled either by dev_watchdog() itself or concurrently\n   by netdev_watchdog_up().","publishedAt":"2026-08-15T05:57:40.314Z","updatedAt":"2026-10-30T12:29:34.809Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"fbb8e79c117adcbfafef33b81d0db853b461bdac","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"2fc2c92320272a99e18bbb102252859b6ee50881","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"6b2330facc90e43b6d7171a0ac12c23dfcbdc30d","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"446fe8ce699ce0a4d702f7b0fcdb50de340b9260","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"8eed5519e496b7a07f441a0f579cb228a33189f7","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netdevice.h","net/core/dev.c","net/sched/sch_generic.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.17","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netdevice.h","net/core/dev.c","net/sched/sch_generic.c"]}],"references":["https://git.kernel.org/stable/c/fbb8e79c117adcbfafef33b81d0db853b461bdac","https://git.kernel.org/stable/c/2fc2c92320272a99e18bbb102252859b6ee50881","https://git.kernel.org/stable/c/6b2330facc90e43b6d7171a0ac12c23dfcbdc30d","https://git.kernel.org/stable/c/446fe8ce699ce0a4d702f7b0fcdb50de340b9260","https://git.kernel.org/stable/c/7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9","https://git.kernel.org/stable/c/8eed5519e496b7a07f441a0f579cb228a33189f7"],"weaknesses":[],"ingestedAt":"2026-10-30T12:48:04.825Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74264.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74264","state":"PUBLISHED","datePublished":"2026-08-15T05:57:40.314Z","dateUpdated":"2026-10-30T12:29:34.809Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.877Z"},"containers":{"cna":{"title":"net: watchdog: fix refcount tracking races","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: watchdog: fix refcount tracking races\n\nBlamed commit converted the untracked dev_hold()/dev_put() calls\nin the watchdog code to use the tracked dev_hold_track()/dev_put_track()\n(which were later renamed/interfaced to netdev_hold() and netdev_put()).\n\nBy introducing dev->watchdog_dev_tracker to store the\nreference tracking information without adding synchronization\nbetween netdev_watchdog_up() and dev_watchdog(), it enabled the\nrace condition where this pointer could be overwritten or freed\nconcurrently, leading to the list corruption crash syzbot reported:\n\nlist_del corruption, ffff888114a18c00->next is NULL\n kernel BUG at lib/list_debug.c:52 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026\nWorkqueue: events_unbound linkwatch_event\n RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52\nCall Trace:\n <TASK>\n  __list_del_entry_valid include/linux/list.h:132 [inline]\n  __list_del_entry include/linux/list.h:246 [inline]\n  list_move_tail include/linux/list.h:341 [inline]\n  ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329\n  netdev_tracker_free include/linux/netdevice.h:4491 [inline]\n  netdev_put include/linux/netdevice.h:4508 [inline]\n  netdev_put include/linux/netdevice.h:4504 [inline]\n  netdev_watchdog_down net/sched/sch_generic.c:600 [inline]\n  dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363\n  dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397\n  linkwatch_do_dev net/core/link_watch.c:184 [inline]\n  linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166\n  __linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240\n  linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314\n  process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314\n  process_scheduled_works kernel/workqueue.c:3397 [inline]\n  worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478\n  kthread+0x370/0x450 kernel/kthread.c:436\n  ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nThis patch has three coordinated parts:\n\n1) Add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations.\n\n2) Remove netdev_watchdog_up() call from netif_carrier_on():\n   This ensures netdev_watchdog_up() is only called from process/BH context\n   (via linkwatch workqueue dev_activate()), allowing us to use\n   spin_lock_bh() for synchronization.\n\n3) Synchronize watchdog up and watchdog timer:\n   Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.\n   Only allocate a new tracker in netdev_watchdog_up() if one is\n   not already present.\n   In dev_watchdog(), ensure we don't release the tracker if the\n   timer was rescheduled either by dev_watchdog() itself or concurrently\n   by netdev_watchdog_up()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"fbb8e79c117adcbfafef33b81d0db853b461bdac","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"2fc2c92320272a99e18bbb102252859b6ee50881","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"6b2330facc90e43b6d7171a0ac12c23dfcbdc30d","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"446fe8ce699ce0a4d702f7b0fcdb50de340b9260","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9","versionType":"git"},{"version":"f12bf6f3f942b37de65eeea8be25903587fec930","status":"affected","lessThan":"8eed5519e496b7a07f441a0f579cb228a33189f7","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netdevice.h","net/core/dev.c","net/sched/sch_generic.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.17","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netdevice.h","net/core/dev.c","net/sched/sch_generic.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/fbb8e79c117adcbfafef33b81d0db853b461bdac"},{"url":"https://git.kernel.org/stable/c/2fc2c92320272a99e18bbb102252859b6ee50881"},{"url":"https://git.kernel.org/stable/c/6b2330facc90e43b6d7171a0ac12c23dfcbdc30d"},{"url":"https://git.kernel.org/stable/c/446fe8ce699ce0a4d702f7b0fcdb50de340b9260"},{"url":"https://git.kernel.org/stable/c/7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9"},{"url":"https://git.kernel.org/stable/c/8eed5519e496b7a07f441a0f579cb228a33189f7"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in net/sched netdev watchdog refcount handling, reached via local carrier/linkwatch and rtnl-driven netdev lifecycle on TX-timeout-capable interfaces (virtio_net, Ethernet NICs), not by processing remote packets.\nAC:L - An attacker controls both sides of the race by concurrently driving carrier up/down transitions and TX watchdog timer expiry; syzbot reproduced this reliably without uncontrollable timing or layout dependencies.\nPR:L - Triggering netdev carrier activation/deactivation and watchdog setup on affected interfaces requires CAP_NET_ADMIN, obtainable by unprivileged users through user/network namespaces or as administrators in cloud VMs with virtio_net.\nUI:N - No victim interaction is required; exploitation needs only attacker-initiated interface churn and concurrent watchdog timer activity.\nS:U - Impact is kernel netdev refcount/tracker corruption within kernel memory; it does not by itself cross VM, container, or IOMMU security boundaries.\nC:H - Unsynchronized watchdog_dev_tracker allows concurrent free/overwrite (use-after-free/double-free) and ref_tracker list corruption, enabling arbitrary kernel memory disclosure.\nI:H - The same refcount/list corruption provides exploitable memory corruption primitives that can be leveraged for arbitrary kernel writes and privilege escalation.\nA:H - The vulnerability provokes kernel BUG/oops panics (demonstrated list_del corruption) and can be repeatedly triggered to crash or deny service via sustained carrier/watchdog races."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:29:34.809Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74264","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:51:40.430593Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:28.702Z"}}]}}}