CVE-2026-90135 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who need to ensure the security and stability of their systems. They should verify Linux kernel versions, apply patches, and monitor system logs to prevent potential crashes. The vulnerability affects Linux kernel versions and requires patching to prevent potential crashes.

Why it matters

A use-after-free vulnerability in the Linux kernel's net device refcount tracker infrastructure can cause a crash when reading /sys/kernel/debug/ref_tracker/* after alloc_percpu() or dev_addr_init() fails in alloc_netdev_mqs(). Defenders should verify Linux kernel versions, apply patches, and monitor system logs to prevent potential crashes.

• Potential system crashes when reading /sys/kernel/debug/ref_tracker/*
• Need to verify Linux kernel versions for exposure
• Apply patches to prevent potential crashes
• Monitor system logs for crashes

Technical summary

The Linux kernel's net device refcount tracker infrastructure has a use-after-free vulnerability. When alloc_percpu() or dev_addr_init() fails in alloc_netdev_mqs(), it can cause a crash when reading /sys/kernel/debug/ref_tracker/*. The vulnerability was introduced by commit 4d92b95ff2f9 (net: add net device refcount tracker infrastructure) and can be triggered when either alloc_percpu() or dev_addr_init() in alloc_netdev_mqs() failed. Defenders should verify Linux kernel versions and apply patches to prevent potential crashes.

Defensive priority

Verify Linux kernel versions and apply patches to prevent potential crashes.

Recommended defensive actions

• Review Linux kernel versions for potential exposure
• Apply patches to fix the vulnerability
• Monitor system logs for crashes
• Verify Linux kernel versions and apply patches to prevent potential crashes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, while the Linux kernel Git repository commits offer technical context. The vulnerability has been resolved by adding missing ref_tracker_dir_exit() to alloc_netdev_mqs(). Defenders should verify Linux kernel versions, apply patches, and monitor system logs to prevent potential crashes. The source confidence is limited, and further verification is required to confirm the affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.