CVE-2026-74479: net: pktgen: fix proc entry use-after-free

In the Linux kernel, the following vulnerability has been resolved:

net: pktgen: fix proc entry use-after-free

pktgenchangename() replaces pktdev->entry while holding t->iflock. pktgenremovedevice() removes the same entry before remdevfromiflist() takes that lock.

This allows the following interleaving:

CPU 0 (NETDEVCHANGENAME) CPU 1 (kpktgend) iflock(t) procremove(pktdev->entry) procremove(pktdev->entry) pktdev->entry = proccreatedata(...) ifunlock(t)

The kthread can pass the stale procdirentry to procremove() after the rename path has freed it. A reproducer with a widened race window reports:

BUG: KASAN: slab-use-after-free in procremove+0x78/0x80 Read of size 8 at addr ffff8881478fea70 by task kpktgend0/67 Call Trace: procremove+0x78/0x80 pktgenremovedevice.isra.0+0x11c/0x4c0 pktgenthreadworker+0x1214/0x6bc0 kthread+0x2c6/0x3b0 Allocated by task 95: proccreate+0x204/0x790 proccreatedata+0x72/0xe0 pktgenthreadwrite+0xd61/0x1510 Freed by task 28: kmemcachefree+0xcb/0x3d0 procfreeinode+0x5b/0x80 rcucore+0x50a/0x1850 The buggy address belongs to the object at ffff8881478fea00 which belongs to the cache procdirentry of size 192

Move procremove() into the iflock-protected list removal helper. Keep it before listdelrcu() to preserve the ordering required by adddevice(). The rename path must then finish replacing the entry before removal, or it observes that the device is no longer on the list.