CVE-2026-64424: netpoll: fix a use-after-free on shutdown path
In the Linux kernel, the following vulnerability has been resolved:
netpoll: fix a use-after-free on shutdown path
There is a use-after-free error on netpoll, which is clearly detected by KASAN.
BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task kworker/9:1 Workqueue: events queueprocess Call Trace: skbdequeue+0x1e/0xb0 queueprocess+0x2c/0x600 processscheduledworks+0x4b6/0x850 workerthread+0x414/0x5a0 Allocated by task 242: netpollsetup+0x201/0x4a0 netpollsetup+0x249/0x550 enabledstore+0x32f/0x380 Freed by task 0: kfree+0x1b7/0x540 rcucore+0x3f8/0x7a0
The problem happens when there is a pending TX worker running in parallel with the cleanup path.
This is what happens on netpoll shutdown path:
1) netpollcleanup() is called 2) set dev->npinfo to NULL 3) callrcu() with rcucleanupnetpollinfo() 3.1) rcucleanupnetpollinfo() tries to cancel all workers with canceldelayedwork(), but doesn't wait for the worker to finish 4) and kfree(npinfo);
Because 3.1) doesn't really cancel the work, as the comment says "we can't call canceldelayedworksync here, as we are in softirq", the TX worker can run after 4).
Tl;DR: queueprocess() is not an RCU reader, it reaches npinfo through the work item via containerof().
Use disabledelayedworksync() to ensure the worker is completely stopped and prevent any future re-arming attempts. Once npinfo is set to NULL, senders will bail out and not queue new work. The disable flag ensures any in-flight re-arming attempts also fail silently.
In the future, we can do the cleanup inline here without needing the npinfo->rcu rcuhead, but that is net-next material.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
On netpoll shutdown, set dev->npinfo to NULL and then use disable_delayed_work_sync() (instead of cancel_delayed_work()) to ensure the TX worker is completely stopped before calling rcu_cleanup_netpoll_info() / kfree(npinfo). This prevents the use-after-free where the worker can still run after npinfo is freed.
Linux kernel netpoll disable flag / enabled_store behavior (disable_delayed_work_sync prerequisite) = ensure disable_delayed_work_sync() completes before freeing npinfo; prevent in-flight re-arming attempts
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A netpoll shutdown must occur while a pending TX worker is running in parallel with the cleanup path. The worker can then access netpoll information after it has been freed.
How can administrators identify evidence of this problem?
The described failure is detected by KASAN as a slab-use-after-free during _raw_spin_lock_irqsave, with a call trace involving skb_dequeue, queue_process, process_scheduled_works, and worker_thread. The affected work is shown running in the events workqueue.
What is the immediate mitigation if an update cannot be applied?
The provided information does not specify a workaround. Reducing or avoiding netpoll shutdown activity while pending TX work may be active would target the described race, but no supported mitigation is stated.