CVE-2026-72493
- Source
- https://cve.org/CVERecord?id=CVE-2026-72493
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72493.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-72493
- Downstream
- Published
- 2026-08-15T05:57:27Z
- Modified
- 2026-10-08T02:51:49Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- net: serialize netif_running() check in enqueue_to_backlog()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: serialize netif_running() check in enqueue_to_backlog()
Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup().
The root cause is a race condition where packets can escape the backlog flushing during device unregistration (e.g., during netns exit).
Commit e9e4dd3267d0 ("net: do not process device backlog during unregistration") introduced a lockless netif_running() check in enqueue_to_backlog() to prevent queuing packets to an unregistering device.
However, this creates a TOCTOU race window.
A lockless transmitter (like veth_xmit) can pass the check before dev_close() clears IFF_UP. If the transmitter is then delayed, flush_all_backlogs() can run and finish before the transmitter grabs the backlog lock and queues the packet. The packet then escapes the flush and triggers UAF later when processed.
Fix this by moving the netif_running() check inside the backlog lock. This serializes the check with the flush work (which also grabs the lock). We then either queue the packet before the flush runs (so it gets flushed), or check netif_running() after the flush/close completes (so it gets dropped).
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72493.json" }- References
-
- https://git.kernel.org/stable/c/2fface6e0bbd6314d1d9d071abf2c4d67548511c
- https://git.kernel.org/stable/c/46762cefe7f4e5bffc1eb467810a7bbb02e461d7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72493.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-72493
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede9e4dd3267d0c5234c5c0f47440456b10875dec9Fixed2fface6e0bbd6314d1d9d071abf2c4d67548511cFixed46762cefe7f4e5bffc1eb467810a7bbb02e461d7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3.2.71Fixed3.3
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3.4.111Fixed3.5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3.12.48Fixed3.13
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3.14.54Fixed3.15
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3.18.22Fixed3.19
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4.1.9Fixed4.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced78b6803a1961369d0b8350ff1f99b7375bbd7a8f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb5d73d9cdd6be22795499890ea928a6f57ef829c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf6533fed1bfa842e391ee50f9a9c5e963c71e579
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2095ab2456da766174cda8bc105d7a7b1bc70e16
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf1fdb184aefa8447560e3ea0e605171592ffee41
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf75c8a3015422128ca150e81c730bc2a471b5f4a
Affected versions
v3.*
v3.12.48
v3.12.49
v3.12.50
v3.12.51
v3.12.52
v3.12.53
v3.12.54
v3.12.55
v3.12.56
v3.12.57
v3.12.58
v3.12.59
v3.12.60
v3.12.61
v3.12.62
v3.12.63
v3.12.64
v3.12.65
v3.12.66
v3.12.67
v3.12.68
v3.12.69
v3.12.70
v3.12.71
v3.12.72
v3.12.73
v3.12.74
v3.14.54
v3.14.55
v3.14.56
v3.14.57
v3.14.58
v3.14.59
v3.14.60
v3.14.61
v3.14.62
v3.14.63
v3.14.64
v3.14.65
v3.14.66
v3.14.67
v3.14.68
v3.14.69
v3.14.70
v3.14.71
v3.14.72
v3.14.73
v3.14.74
v3.14.75
v3.14.76
v3.14.77
v3.14.78
v3.14.79
v3.18.100
v3.18.101
v3.18.102
v3.18.103
v3.18.104
v3.18.105
v3.18.106
v3.18.107
v3.18.108
v3.18.109
v3.18.110
v3.18.111
v3.18.112
v3.18.113
v3.18.114
v3.18.115
v3.18.116
v3.18.117
v3.18.118
v3.18.119
v3.18.120
v3.18.121
v3.18.122
v3.18.123
v3.18.124
v3.18.125
v3.18.126
v3.18.127
v3.18.128
v3.18.129
v3.18.130
v3.18.131
v3.18.132
v3.18.133
v3.18.134
v3.18.135
v3.18.136
v3.18.137
v3.18.138
v3.18.139
v3.18.140
v3.18.22
v3.18.23
v3.18.24
v3.18.25
v3.18.26
v3.18.27
v3.18.28
v3.18.29
v3.18.30
v3.18.31
v3.18.32
v3.18.33
v3.18.34
v3.18.35
v3.18.36
v3.18.37
v3.18.38
v3.18.39
v3.18.40
v3.18.41
v3.18.42
v3.18.43
v3.18.44
v3.18.45
v3.18.46
v3.18.47
v3.18.48
v3.18.49
v3.18.50
v3.18.51
v3.18.52
v3.18.53
v3.18.54
v3.18.55
v3.18.56
v3.18.57
v3.18.58
v3.18.59
v3.18.60
v3.18.61
v3.18.62
v3.18.63
v3.18.64
v3.18.65
v3.18.66
v3.18.67
v3.18.68
v3.18.69
v3.18.70
v3.18.71
v3.18.72
v3.18.73
v3.18.74
v3.18.75
v3.18.76
v3.18.77
v3.18.78
v3.18.79
v3.18.80
v3.18.81
v3.18.82
v3.18.83
v3.18.84
v3.18.85
v3.18.86
v3.18.87
v3.18.88
v3.18.89
v3.18.90
v3.18.91
v3.18.92
v3.18.93
v3.18.94
v3.18.95
v3.18.96
v3.18.97
v3.18.98
v3.18.99
v3.2.100
v3.2.101
v3.2.102
v3.2.71
v3.2.72
v3.2.73
v3.2.74
v3.2.75
v3.2.76
v3.2.77
v3.2.78
v3.2.79
v3.2.80
v3.2.81
v3.2.82
v3.2.83
v3.2.84
v3.2.85
v3.2.86
v3.2.87
v3.2.88
v3.2.89
v3.2.90
v3.2.91
v3.2.92
v3.2.93
v3.2.94
v3.2.95
v3.2.96
v3.2.97
v3.2.98
v3.2.99
v3.4.111
v3.4.112
v3.4.113
v4.*
v4.1.10
v4.1.11
v4.1.12
v4.1.13
v4.1.14
v4.1.15
v4.1.16
v4.1.17
v4.1.18
v4.1.19
v4.1.20
v4.1.21
v4.1.22
v4.1.23
v4.1.24
v4.1.25
v4.1.26
v4.1.27
v4.1.28
v4.1.29
v4.1.30
v4.1.31
v4.1.32
v4.1.33
v4.1.34
v4.1.35
v4.1.36
v4.1.37
v4.1.38
v4.1.39
v4.1.40
v4.1.41
v4.1.42
v4.1.43
v4.1.44
v4.1.45
v4.1.46
v4.1.47
v4.1.48
v4.1.49
v4.1.50
v4.1.51
v4.1.52
v4.1.9