CVE-2026-72493
Received Received - Intake

Race Condition in Linux Kernel Netif Backlog Handling

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup(). The root cause is a race condition where packets can escape the backlog flushing during device unregistration (e.g., during netns exit). Commit e9e4dd3267d0 ("net: do not process device backlog during unregistration") introduced a lockless netif_running() check in enqueue_to_backlog() to prevent queuing packets to an unregistering device. However, this creates a TOCTOU race window. A lockless transmitter (like veth_xmit) can pass the check before dev_close() clears IFF_UP. If the transmitter is then delayed, flush_all_backlogs() can run and finish before the transmitter grabs the backlog lock and queues the packet. The packet then escapes the flush and triggers UAF later when processed. Fix this by moving the netif_running() check inside the backlog lock. This serializes the check with the flush work (which also grabs the lock). We then either queue the packet before the flush runs (so it gets flushed), or check netif_running() after the flush/close completes (so it gets dropped).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72493
EUVD
EUVD-2026-59392

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's networking subsystem. It occurs when packets are processed during device unregistration, such as when a network namespace exits. The vulnerability allows packets to escape backlog flushing, potentially leading to a use-after-free (UAF) condition in functions like fib_rules_lookup(). The root cause is a time-of-check to time-of-use (TOCTOU) issue where a lockless check in enqueue_to_backlog() conflicts with device state changes.

Impact Analysis

This vulnerability could allow an attacker to trigger a kernel use-after-free, leading to system crashes or potential privilege escalation. It primarily affects systems running vulnerable Linux kernel versions where network devices are frequently unregistered or network namespaces are used.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this race condition in enqueue_to_backlog(). The vulnerability is resolved by moving the netif_running() check inside the backlog lock to prevent the TOCTOU race.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72493. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart