Look up another CVE · open CVE-2026-72493 in the interactive tracker
CVE-2026-72493
net: serialize netif_running() check in enqueue_to_backlog()
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/core. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72493 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup(). The root cause is a race condition where packets can escape the backlog flushing during device unregistration (e.g., during netns exit). Commit e9e4dd3267d0 ("net: do not process device backlog during unregistration") introduced a lockless netif_running() check in enqueue_to_backlog() to prevent queuing packets to an unregistering device. However, this creates a TOCTOU race window. A lockless transmitter (like veth_xmit) can pass the check before dev_close() clears IFF_UP. If the transmitter is then delayed, flush_all_backlogs() can run and finish before the transmitter grabs the backlog lock and queues the packet. The packet then escapes the flush and triggers UAF later when processed. Fix this by moving the netif_running() check inside the backlog lock. This serializes the check with the flush work (which also grabs the lock). We then either queue the packet before the flush runs (so it gets flushed), or check netif_running() after the flush/close completes (so it gets dropped).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/core/dev.c
- What this is
- NETWORKING [GENERAL]MAINTAINERS section matched on net/ · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 9.9 critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.39%, higher than 31.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/core
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.2 | 6.18.57 | b422e3eff0ed |
| 4.2 | 7.1.5 | 2fface6e0bbd |
| 4.2 | 7.2 | 46762cefe7f4 |
| 3.2.71 | 0 | 0 |
| 3.4.111 | 0 | 0 |
| 3.12.48 | 0 | 0 |
| 3.14.54 | 0 | 0 |
| 3.18.22 | 0 | 0 |
| 4.1.9 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is in the generic per-CPU backlog receive path (`netif_rx`/`netif_receive_skb` -> `enqueue_to_backlog`); packets can originate from remote peers reaching veth/bridge/NIC interfaces, and syzbot reproduced it via network transmit/receive activity during device unregistration.
- AC:LAttack complexity, low
- The attacker controls both racing sides by concurrently flooding packets through a lockless transmitter (e.g. veth) while unregistering the device/netns (e.g. `ip link del` or netns exit); no victim-specific timing or memory layout is required beyond repeatable parallel traffic and teardown.
- PR:LPrivileges required, low
- Triggering veth creation, traffic injection, and netdev/netns teardown requires only `CAP_NET_ADMIN` inside a network namespace, obtainable by an unprivileged local user via user namespaces (`unshare -Urn`); init-namespace root is not required.
- UI:NUser interaction, none
- Exploitation needs only the attacker's own concurrent packet transmission and interface/netns teardown; no independent action by another user or administrator is required at trigger time.
- S:CScope, changed
- The use-after-free is triggered from within an isolated network namespace yet corrupts host-global kernel routing state (`fib_rules_lookup` on freed namespace/rule data), crossing the container/netns security boundary into the host kernel's integrity and availability.
- C:HConfidentiality impact, high
- KASAN reported slab-use-after-free in `fib_rules_lookup()` walking `net->rules_ops`; freed namespace/device-associated structures can be reallocated and read through stale pointers, yielding an attacker-influenceable kernel memory read/disclosure primitive.
- I:HIntegrity impact, high
- Processing the escaped backlog skb invokes routing through freed `fib_rules_ops` and indirect function pointers (`ops->match`/`ops->action`); UAF on these heap objects enables heap grooming, control-flow hijack, and arbitrary kernel write leading to privilege escalation.
- A:HAvailability impact, high
- Confirmed slab-use-after-free in core packet processing during device unregistration reliably causes kernel oops/panic (syzbot KASAN splat in `fib_rules_lookup()`), and repeated triggering can deny service to the entire host.