PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72493 Linux CVE debrief

A race condition vulnerability was found in the Linux kernel's net: serialize netif_running() check in enqueue_to_backlog(). This issue allows packets to escape the backlog flushing during device unregistration, potentially leading to a use-after-free (UAF) error. The vulnerability was reported by Syzbot and is related to a TOCTOU (time-of-check to time-of-use) race window introduced by a lockless netif_running() check in enqueue_to_backlog(). The root cause is a race condition where packets can escape the backlog flushing during device unregistration (e.g., during netns exit). Commit e9e4dd3267d0 (net: do not process device backlog during unregistration) introduced a lockless netif_running() check in enqueue_to_backlog() to prevent queuing packets to an unregistering device. However, this creates a TOCTOU race window. A lockless transmitter (like veth_xmit) can pass the check before dev_close() clears IFF_UP. If the transmitter is then delayed, flush_all_backlogs() can run and finish before the transmitter grabs the backlog lock and queues the packet. The packet then escapes the flush and triggers UAF later when processed. Fix this by moving the netif_running() check inside the backlog lock. This serializes the check with the flush work (which also grabs the lock). We then either queue the packet before the flush runs (so it gets flushed), or check netif_running() after the flush/close completes (so it gets dropped). Linux kernel developers should verify system configurations, review device unregistration processes, and ensure that devices are properly unregistered to mitigate this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-08-15
Advisory published
2026-08-15
Advisory updated
2026-08-15

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to apply the patch or mitigate the issue. System administrators and security teams should review system configurations and ensure that devices are properly unregistered to prevent potential UAF errors.

Technical summary

The vulnerability is caused by a TOCTOU race window introduced by a lockless netif_running() check in enqueue_to_backlog(). This allows packets to escape the backlog flushing during device unregistration, potentially leading to a use-after-free (UAF) error. The fix involves moving the netif_running() check inside the backlog lock to serialize the check with the flush work. This change ensures that the check is performed in a safe and controlled environment, preventing the UAF error.

Defensive priority

High

Recommended defensive actions

  • Apply the patch that moves the netif_running() check inside the backlog lock to serialize the check with the flush work.
  • Monitor for potential UAF errors in the Linux kernel's net: enqueue_to_backlog() function.
  • Review system configurations and ensure that devices are properly unregistered.
  • Perform a thorough review of the Linux kernel's net: enqueue_to_backlog() function to identify potential vulnerabilities.
  • Implement compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by Syzbot and is related to a TOCTOU (time-of-check to time-of-use) race window introduced by a lockless netif_running() check in enqueue_to_backlog(). This issue allows packets to escape the backlog flushing during device unregistration, potentially leading to a use-after-free (UAF) error. The fix involves moving the netif_running() check inside the backlog lock to serialize the check with the flush work. Linux kernel developers should verify system configurations, review device unregistration processes, and ensure that devices are properly unregistered to mitigate this vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:23.643Z and has not been modified since then.