CVE-2026-93279: staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
In the Linux kernel, the following vulnerability has been resolved:
staging: octeon: add missing taskletkill in cvmocttxshutdown
The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvmocttxdocleanup. There can be a pending tasklet in the queue which might run after the cvmoctremove() frees netdevice structures, causing a use-after-free in cvmocttxdocleanup() as it iterates cvmoctdevice[] which is an array of netdevice pointers. Add taskletkill() after freeirq() to ensure the tasklet is no longer scheduled or running before teardown proceeds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.270 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.221 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.188 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Configuration
Call tasklet_kill() after free_irq() in cvm_oct_tx_shutdown to ensure the TX cleanup tasklet is no longer scheduled or running before teardown proceeds.
Linux kernel staging octeon cvm_oct_tx_shutdown tasklet teardown = tasklet_kill() after free_irq()
Event History
Frequently Asked Questions
When can this use-after-free occur?
It can occur during device removal if the TX cleanup tasklet was queued by the watchdog IRQ handler and runs after cvm_oct_remove() has freed net_device structures.
What component and execution path are involved?
The issue affects the staging Octeon network driver’s transmit cleanup path. The queued tasklet executes cvm_oct_tx_do_cleanup(), which iterates cvm_oct_device[], an array containing netdevice pointers.
What is the required remediation?
Teardown must call tasklet_kill() after free_irq() in cvm_oct_tx_shutdown so that the TX cleanup tasklet cannot remain scheduled or running while device structures are freed.