CVE-2026-74329

Received Received - Intake

Linux Kernel PM Notifier Use-After-Free in Watchdog

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdog_register_device() registers wdd->pm_nb when WDOG_NO_PING_ON_SUSPEND is set, but watchdog_unregister_device() does not remove it. This leaves an embedded notifier block on the PM notifier chain after the watchdog device has been unregistered. A later suspend/resume notification can then call watchdog_pm_notifier() with a stale watchdog_device pointer, or at minimum after wdd->wd_data has been cleared by watchdog_dev_unregister(). Unregister the PM notifier before tearing down the watchdog device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74329

EUVD

EUVD-2026-59476

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing cleanup step when unregistering a watchdog device. When a watchdog device is registered with a specific flag, a power management (PM) notifier is also registered. However, when the watchdog device is later unregistered, this PM notifier is not removed from the system's PM notifier chain.

Detection Guidance

This vulnerability is specific to the Linux kernel's watchdog subsystem and may not have direct network detection methods. Check kernel logs for watchdog-related errors or warnings using: dmesg | grep watchdog. Verify if watchdog devices are properly unregistered by inspecting kernel messages during system suspend/resume events.

Impact Analysis

This could lead to a stale pointer being used during suspend/resume operations, potentially causing system instability or crashes. It may also result in incorrect behavior of the watchdog subsystem if the device is reused after unregistration.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a kernel-level watchdog mechanism in Linux. Compliance impacts would depend on system-specific configurations and usage rather than this specific issue.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel updates from your distribution vendor. If affected, ensure watchdog devices are properly unregistered during system shutdown or reboot to prevent stale notifier chain entries.

Hi! I’m here to help you understand CVE-2026-74329. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70