CVE-2026-74543: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
In the Linux kernel, the following vulnerability has been resolved:
net: udptunnel: fix memory leak in udptunnelnicunregister()
syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.
When device registration fails (e.g. in registernetdevice()), netdev core unwinds by sending a single NETDEVUNREGISTER notification. If work was queued during NETDEVREGISTER (utn->workpending is set), udptunnelnicunregister() returns early:
if (utn->workpending) return;
Because failed registrations do not enter netdevwaitallrefsany(), no subsequent NETDEVUNREGISTER rebroadcast will ever occur. As a result, the struct udptunnelnic allocated in udptunnelnicalloc() is leaked permanently.
Fix this by removing the early return. Instead, synchronously cancel any pending work with canceldelayedworksync() before freeing @utn.
To be able to call canceldelayedworksync() while holding RTNL (the work also needs RTNL), switch udptunnelnicdevicesyncwork() to rtnltrylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queuedelayedwork()) to prevent high CPU contention while waiting for RTNL lock.
The utn->workpending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work.
[1] BUG: memory leak unreferenced object 0xffff888127d5f840 (size 96): comm "syz-executor", pid 5806, jiffies 4294942188 backtrace (crc 99fdb6c8): kmallocnoprof+0x3bf/0x550 udptunnelnicalloc net/ipv4/udptunnelnic.c:756 [inline] udptunnelnicregister net/ipv4/udptunnelnic.c:833 [inline] udptunnelnicnetdeviceevent+0x804/0xab0 net/ipv4/udptunnelnic.c:931 notifiercallchain+0x59/0x160 kernel/notifier.c:85 callnetdevicenotifiersinfo+0x7d/0xb0 net/core/dev.c:2250 registernetdevice+0xc10/0xeb0 net/core/dev.c:11478
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
To avoid holding RTNL while cancelling pending work, change udp_tunnel_nic_device_sync_work() to use rtnl_trylock() (instead of requiring RTNL) when cancelling queued work in udp_tunnel_nic_unregister().
Linux kernel (udp_tunnel NIC offload) udp_tunnel_nic_device_sync_work RTNL locking behavior = rtnl_trylock() - Configuration
Fix the memory leak by removing the early return in the udp_tunnel_nic_unregister() path so failed registrations properly cancel pending work (rather than returning before notifier/work cancellation and freeing).
Linux kernel (netdev/udp_tunnel) udp_tunnel_nic_unregister early return = remove the early return - Configuration
Remove the utn->work_pending bookkeeping, as the workqueue core already tracks pending/running state of the work and it is no longer needed.
Linux kernel (udp_tunnel NIC offload) utn->work_pending bookkeeping = removed - Compensating control
If device registration fails and deferred work was queued (via queue_delayed_work()), ensure the pending work is synchronously cancelled with cancel_delayed_work_sync() before freeing the affected udp_tunnel_nic structure to prevent the memory leak.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74543?
CVE-2026-74543 has a severity rating of 8, indicating a high risk level.
How do I fix CVE-2026-74543?
To fix CVE-2026-74543, update to the latest version of the Linux Kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-74543?
CVE-2026-74543 affects systems running specific versions of the Linux Kernel that implement UDP tunnel functionality.
What impact does CVE-2026-74543 have?
CVE-2026-74543 can lead to a memory leak in the UDP tunnel NIC offload code, which may affect system stability.
When was CVE-2026-74543 published?
CVE-2026-74543 was published on August 15, 2026.