PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72493 Linux CVE debrief

A race condition vulnerability was found in the Linux kernel's net: serialize netif_running() check in enqueue_to_backlog(). This issue allows packets to escape the backlog flushing during device unregistration, potentially leading to a use-after-free (UAF) error. The vulnerability was reported by Syzbot and is related to a TOCTOU (time-of-check to time-of-use) race window introduced by a lockless netif_running() check in enqueue_to_backlog(). The root cause is a race condition where packets can escape the backlog flushing during device unregistration (e.g., during netns exit). Commit e9e4dd3267d0 (net: do not process device backlog during unregistration) introduced a lockless netif_running() check in enqueue_to_backlog() to prevent queuing packets to an unregistering device. However, this creates a TOCTOU race window. A lockless transmitter (like veth_xmit) can pass the check before dev_close() clears IFF_UP. If the transmitter is then delayed, flush_all_backlogs() can run and finish before the transmitter grabs the backlog lock and queues the packet. The packet then escapes the flush and triggers UAF later when processed. Fix this by moving the netif_running() check inside the backlog lock. This serializes the check with the flush work (which also grabs the lock). We then either queue the packet before the flush runs (so it gets flushed), or check netif_running() after the flush/close completes (so it gets dropped). Linux kernel developers should verify system configurations, review device unregistration processes, and ensure that devices are properly unregistered to mitigate this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-08-15
Advisory published
2026-08-15
Advisory updated
2026-08-15

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to apply the patch or mitigate the issue. System administrators and security teams should review system configurations and ensure that devices are properly unregistered to prevent potential UAF errors.

Technical summary

The vulnerability is caused by a TOCTOU race window introduced by a lockless netif_running() check in enqueue_to_backlog(). This allows packets to escape the backlog flushing during device unregistration, potentially leading to a use-after-free (UAF) error. The fix involves moving the netif_running() check inside the backlog lock to serialize the check with the flush work. This change ensures that the check is performed in a safe and controlled environment, preventing the UAF error.

Defensive priority

High

Recommended defensive actions

  • Apply the patch that moves the netif_running() check inside the backlog lock to serialize the check with the flush work.
  • Monitor for potential UAF errors in the Linux kernel's net: enqueue_to_backlog() function.
  • Review system configurations and ensure that devices are properly unregistered.
  • Perform a thorough review of the Linux kernel's net: enqueue_to_backlog() function to identify potential vulnerabilities.
  • Implement compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by Syzbot and is related to a TOCTOU (time-of-check to time-of-use) race window introduced by a lockless netif_running() check in enqueue_to_backlog(). This issue allows packets to escape the backlog flushing during device unregistration, potentially leading to a use-after-free (UAF) error. The fix involves moving the netif_running() check inside the backlog lock to serialize the check with the flush work. Linux kernel developers should verify system configurations, review device unregistration processes, and ensure that devices are properly unregistered to mitigate this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-72493 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-72493

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-72493 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72493

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2fface6e0bbd6314d1d9d071abf2c4d67548511c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.