CVE-2026-74543

In the Linux kernel, the following vulnerability has been resolved:

net: udptunnel: fix memory leak in udptunnelnicunregister()

syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.

When device registration fails (e.g. in registernetdevice()), netdev core unwinds by sending a single NETDEVUNREGISTER notification. If work was queued during NETDEVREGISTER (utn->workpending is set), udptunnelnic_unregister() returns early:

if (utn->work_pending)
    return;

Because failed registrations do not enter netdevwaitallrefsany(), no subsequent NETDEVUNREGISTER rebroadcast will ever occur. As a result, the struct udptunnelnic allocated in udptunnelnic_alloc() is leaked permanently.

Fix this by removing the early return. Instead, synchronously cancel any pending work with canceldelayedwork_sync() before freeing @utn.

To be able to call canceldelayedworksync() while holding RTNL (the work also needs RTNL), switch udptunnelnicdevicesyncwork() to rtnltrylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queuedelayed_work()) to prevent high CPU contention while waiting for RTNL lock.

The utn->work_pending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work.

[1] BUG: memory leak unreferenced object 0xffff888127d5f840 (size 96): comm "syz-executor", pid 5806, jiffies 4294942188 backtrace (crc 99fdb6c8): _kmallocnoprof+0x3bf/0x550 udptunnelnicalloc net/ipv4/udptunnelnic.c:756 [inline] udptunnelnicregister net/ipv4/udptunnelnic.c:833 [inline] udptunnelnicnetdeviceevent+0x804/0xab0 net/ipv4/udptunnelnic.c:931 notifiercallchain+0x59/0x160 kernel/notifier.c:85 callnetdevicenotifiersinfo+0x7d/0xb0 net/core/dev.c:2250 registernetdevice+0xc10/0xeb0 net/core/dev.c:11478