CVE-2026-74543

Received Received - Intake

Memory Leak in Linux Kernel UDP Tunnel NIC Offload

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() syzbot reported a memory leak [1] in the UDP tunnel NIC offload code. When device registration fails (e.g. in register_netdevice()), netdev core unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued during NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister() returns early: if (utn->work_pending) return; Because failed registrations do not enter netdev_wait_allrefs_any(), no subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked permanently. Fix this by removing the early return. Instead, synchronously cancel any pending work with cancel_delayed_work_sync() before freeing @utn. To be able to call cancel_delayed_work_sync() while holding RTNL (the work also needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work()) to prevent high CPU contention while waiting for RTNL lock. The utn->work_pending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work. [1] BUG: memory leak unreferenced object 0xffff888127d5f840 (size 96): comm "syz-executor", pid 5806, jiffies 4294942188 backtrace (crc 99fdb6c8): __kmalloc_noprof+0x3bf/0x550 udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline] udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline] udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931 notifier_call_chain+0x59/0x160 kernel/notifier.c:85 call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250 register_netdevice+0xc10/0xeb0 net/core/dev.c:11478

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74543

EUVD

EUVD-2026-59736

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's UDP tunnel NIC offload code. When device registration fails, a struct udp_tunnel_nic is not properly freed, causing a permanent memory leak. The issue occurs because the cleanup process skips freeing the memory when work is pending during registration failure.

Detection Guidance

This vulnerability is a kernel memory leak in the UDP tunnel NIC offload code. Detection requires checking for memory leaks in the kernel, particularly related to network device registration failures. Use commands like dmesg | grep -i leak or cat /proc/meminfo to monitor memory usage. Kernel logs may show warnings about unreferenced objects during network device operations.

Impact Analysis

This vulnerability can lead to gradual memory exhaustion on systems using UDP tunnel NIC offload features. Over time, it may cause system performance degradation, crashes, or denial of service due to unavailable memory resources.

Compliance Impact

This vulnerability causes a memory leak in the Linux kernel's UDP tunnel NIC offload code. While it does not directly impact data privacy or security controls, memory leaks can lead to system instability or crashes, which may indirectly affect compliance by disrupting operations handling sensitive data under standards like GDPR or HIPAA.

Mitigation Strategies

Apply the kernel patch that fixes the memory leak in udp_tunnel_nic_unregister(). Update your Linux kernel to a version containing the fix. If immediate patching is not possible, monitor network device registration failures and restart affected services to clear leaked memory.

Hi! I’m here to help you understand CVE-2026-74543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70