CVE-2026-68332

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Fix potential use-after-free in airohappedeinit()

airohappedeinit() replaces the NPU pointer with NULL via rcureplacepointer() but does not wait for existing RCU readers to exit before calling ppedeinit() and airohanpu_put(). This can cause a use-after-free if a reader in an RCU read-side critical section still holds a reference to the NPU when it is freed.

The init path (airohappeinit) already calls synchronizercu() after rcuassignpointer(), but the deinit path introduced in commit 6abcf751bc08 ("net: airoha: Fix schedule while atomic in airohappedeinit()") omitted the matching barrier when switching from rcureadlock()/rcudereference() to rcureplacepointer().

Add synchronizercu() before ppedeinit() to ensure all existing RCU readers have completed before the NPU resources are released.