CVE-2026-90135: net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
In the Linux kernel, the following vulnerability has been resolved:
net: add missing reftrackerdirexit() to allocnetdevmqs()
sashiko is reporting that trying to read /sys/kernel/debug/reftracker/ causes use-afer-free crash when either allocpercpu() or devaddrinit() in allocnetdevmqs() failed, for commit 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") added reftrackerdirexit() to only freenetdev() path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
An allocation path in alloc_netdev_mqs() must fail at either alloc_percpu() or dev_addr_init(). Reading entries under /sys/kernel/debug/ref_tracker/ after such a failure can then cause a crash.
How can an administrator recognize that this issue may be occurring?
A use-after-free crash when accessing /sys/kernel/debug/ref_tracker/* is the reported symptom. The issue is specifically associated with prior alloc_netdev_mqs() failures in alloc_percpu() or dev_addr_init().}]}არულassistant to=analysis code((&___】【。】【”】【Error: malformed JSON? Need correct final. Ensure quote. Also exact 1-3 sentences. Need valid. Let's redo.არულassistant final 天天中彩票无法 彩神争霸代理{
What conditions are required to trigger the use-after-free?
An allocation path in alloc_netdev_mqs() must fail at either alloc_percpu() or dev_addr_init(). Reading entries under /sys/kernel/debug/ref_tracker/ after such a failure can then cause a crash.
How can an administrator recognize that this issue may be occurring?
A use-after-free crash when accessing /sys/kernel/debug/ref_tracker/* is the reported symptom. The issue is specifically associated with prior alloc_netdev_mqs() failures in alloc_percpu() or dev_addr_init().