UBUNTU-CVE-2026-74264: Race Condition
In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races Blamed commit converted the untracked devhold()/devput() calls in the watchdog code to use the tracked devholdtrack()/devputtrack() (which were later renamed/interfaced to netdevhold() and netdevput()). By introducing dev->watchdogdevtracker to store the reference tracking information without adding synchronization between netdevwatchdogup() and devwatchdog(), it enabled the race condition where this pointer could be overwritten or freed concurrently, leading to the list corruption crash syzbot reported: listdel corruption, ffff888114a18c00->next is NULL kernel BUG at lib/listdebug.c:52 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: eventsunbound linkwatchevent RIP: 0010:listdelentryvalidorreport.cold+0x22/0x2a lib/listdebug.c:52 Call Trace: <TASK> listdelentryvalid include/linux/list.h:132 [inline] listdelentry include/linux/list.h:246 [inline] listmovetail include/linux/list.h:341 [inline] reftrackerfree+0x1a7/0x6c0 lib/reftracker.c:329 netdevtrackerfree include/linux/netdevice.h:4491 [inline] netdevput include/linux/netdevice.h:4508 [inline] netdevput include/linux/netdevice.h:4504 [inline] netdevwatchdogdown net/sched/schgeneric.c:600 [inline] devdeactivatemany+0x28c/0xfe0 net/sched/schgeneric.c:1363 devdeactivate+0x109/0x1d0 net/sched/schgeneric.c:1397 linkwatchdodev net/core/linkwatch.c:184 [inline] linkwatchdodev+0xd3/0x120 net/core/linkwatch.c:166 linkwatchrunqueue+0x3a5/0x810 net/core/linkwatch.c:240 linkwatchevent+0x8f/0xc0 net/core/linkwatch.c:314 processonework+0xa0e/0x1980 kernel/workqueue.c:3314 processscheduledworks kernel/workqueue.c:3397 [inline] workerthread+0x5ef/0xe50 kernel/workqueue.c:3478 kthread+0x370/0x450 kernel/kthread.c:436 retfromfork+0x69a/0xc80 arch/x86/kernel/process.c:158 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:245 This patch has three coordinated parts: 1) Add dev->watchdoglock and dev->watchdogrefheld to serialize watchdog operations. 2) Remove netdevwatchdogup() call from netifcarrieron(): This ensures netdevwatchdogup() is only called from process/BH context (via linkwatch workqueue devactivate()), allowing us to use spinlockbh() for synchronization. 3) Synchronize watchdog up and watchdog timer: Protect netdevwatchdogup() with txgloballock and watchdoglock. Only allocate a new tracker in netdevwatchdogup() if one is not already present. In devwatchdog(), ensure we don't release the tracker if the timer was rescheduled either by devwatchdog() itself or concurrently by netdevwatchdogup().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Apply the Linux kernel watchdog refcount-tracking race fix: remove the netdev_watchdog_up() call from netif_carrier_on(); add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations; protect netdev_watchdog_up() with tx_global_lock and watchdog_lock; allocate dev->watchdog_dev_tracker only when absent; and in dev_watchdog(), do not release the tracker when the timer was rescheduled by dev_watchdog() or concurrently by netdev_watchdog_up().
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs local access with low privileges. Exploitation involves racing netdev_watchdog_up() against dev_watchdog(), allowing watchdog reference-tracking state to be overwritten or freed concurrently.
What is the likely impact of successful exploitation?
The documented failure mode is list corruption that can crash the kernel, producing a kernel BUG or Oops. The assigned vector also rates confidentiality, integrity, and availability impact as high.
Which Ubuntu kernel packages are identified as affected?
The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
How can I determine whether a system may have encountered this vulnerability?
Look for kernel crash diagnostics involving list_del corruption, a NULL next pointer, or a BUG in lib/list_debug.c, potentially with watchdog-related call paths such as dev_watchdog and linkwatch_event. The supplied crash example also shows KASAN-enabled kernel diagnostics.