{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74264", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.877Z", "datePublished": "2026-08-15T05:57:40.314Z", "dateUpdated": "2026-08-15T05:57:40.314Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T05:57:40.314Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: watchdog: fix refcount tracking races\n\nBlamed commit converted the untracked dev_hold()/dev_put() calls\nin the watchdog code to use the tracked dev_hold_track()/dev_put_track()\n(which were later renamed/interfaced to netdev_hold() and netdev_put()).\n\nBy introducing dev->watchdog_dev_tracker to store the\nreference tracking information without adding synchronization\nbetween netdev_watchdog_up() and dev_watchdog(), it enabled the\nrace condition where this pointer could be overwritten or freed\nconcurrently, leading to the list corruption crash syzbot reported:\n\nlist_del corruption, ffff888114a18c00->next is NULL\n kernel BUG at lib/list_debug.c:52 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026\nWorkqueue: events_unbound linkwatch_event\n RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52\nCall Trace:\n <TASK>\n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:246 [inline]\n list_move_tail include/linux/list.h:341 [inline]\n ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329\n netdev_tracker_free include/linux/netdevice.h:4491 [inline]\n netdev_put include/linux/netdevice.h:4508 [inline]\n netdev_put include/linux/netdevice.h:4504 [inline]\n netdev_watchdog_down net/sched/sch_generic.c:600 [inline]\n dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363\n dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397\n linkwatch_do_dev net/core/link_watch.c:184 [inline]\n linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166\n __linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240\n linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314\n process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314\n process_scheduled_works kernel/workqueue.c:3397 [inline]\n worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478\n kthread+0x370/0x450 kernel/kthread.c:436\n ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nThis patch has three coordinated parts:\n\n1) Add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations.\n\n2) Remove netdev_watchdog_up() call from netif_carrier_on():\n This ensures netdev_watchdog_up() is only called from process/BH context\n (via linkwatch workqueue dev_activate()), allowing us to use\n spin_lock_bh() for synchronization.\n\n3) Synchronize watchdog up and watchdog timer:\n Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.\n Only allocate a new tracker in netdev_watchdog_up() if one is\n not already present.\n In dev_watchdog(), ensure we don't release the tracker if the\n timer was rescheduled either by dev_watchdog() itself or concurrently\n by netdev_watchdog_up()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/netdevice.h", "net/core/dev.c", "net/sched/sch_generic.c"], "versions": [{"version": "f12bf6f3f942b37de65eeea8be25903587fec930", "lessThan": "446fe8ce699ce0a4d702f7b0fcdb50de340b9260", "status": "affected", "versionType": "git"}, {"version": "f12bf6f3f942b37de65eeea8be25903587fec930", "lessThan": "7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9", "status": "affected", "versionType": "git"}, {"version": "f12bf6f3f942b37de65eeea8be25903587fec930", "lessThan": "8eed5519e496b7a07f441a0f579cb228a33189f7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/netdevice.h", "net/core/dev.c", "net/sched/sch_generic.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/446fe8ce699ce0a4d702f7b0fcdb50de340b9260"}, {"url": "https://git.kernel.org/stable/c/7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9"}, {"url": "https://git.kernel.org/stable/c/8eed5519e496b7a07f441a0f579cb228a33189f7"}], "title": "net: watchdog: fix refcount tracking races", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/netdevice.h", "net/core/dev.c", "net/sched/sch_generic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "446fe8ce699ce0a4d702f7b0fcdb50de340b9260", "status": "affected", "version": "f12bf6f3f942b37de65eeea8be25903587fec930", "versionType": "git"}, {"lessThan": "7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9", "status": "affected", "version": "f12bf6f3f942b37de65eeea8be25903587fec930", "versionType": "git"}, {"lessThan": "8eed5519e496b7a07f441a0f579cb228a33189f7", "status": "affected", "version": "f12bf6f3f942b37de65eeea8be25903587fec930", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/netdevice.h", "net/core/dev.c", "net/sched/sch_generic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: watchdog: fix refcount tracking races\n\nBlamed commit converted the untracked dev_hold()/dev_put() calls\nin the watchdog code to use the tracked dev_hold_track()/dev_put_track()\n(which were later renamed/interfaced to netdev_hold() and netdev_put()).\n\nBy introducing dev->watchdog_dev_tracker to store the\nreference tracking information without adding synchronization\nbetween netdev_watchdog_up() and dev_watchdog(), it enabled the\nrace condition where this pointer could be overwritten or freed\nconcurrently, leading to the list corruption crash syzbot reported:\n\nlist_del corruption, ffff888114a18c00->next is NULL\n kernel BUG at lib/list_debug.c:52 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026\nWorkqueue: events_unbound linkwatch_event\n RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52\nCall Trace:\n <TASK>\n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:246 [inline]\n list_move_tail include/linux/list.h:341 [inline]\n ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329\n netdev_tracker_free include/linux/netdevice.h:4491 [inline]\n netdev_put include/linux/netdevice.h:4508 [inline]\n netdev_put include/linux/netdevice.h:4504 [inline]\n netdev_watchdog_down net/sched/sch_generic.c:600 [inline]\n dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363\n dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397\n linkwatch_do_dev net/core/link_watch.c:184 [inline]\n linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166\n __linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240\n linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314\n process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314\n process_scheduled_works kernel/workqueue.c:3397 [inline]\n worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478\n kthread+0x370/0x450 kernel/kthread.c:436\n ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nThis patch has three coordinated parts:\n\n1) Add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations.\n\n2) Remove netdev_watchdog_up() call from netif_carrier_on():\n This ensures netdev_watchdog_up() is only called from process/BH context\n (via linkwatch workqueue dev_activate()), allowing us to use\n spin_lock_bh() for synchronization.\n\n3) Synchronize watchdog up and watchdog timer:\n Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock.\n Only allocate a new tracker in netdev_watchdog_up() if one is\n not already present.\n In dev_watchdog(), ensure we don't release the tracker if the\n timer was rescheduled either by dev_watchdog() itself or concurrently\n by netdev_watchdog_up()."}], "id": "CVE-2026-74264", "lastModified": "2026-08-15T06:22:25.670", "metrics": {}, "published": "2026-08-15T06:22:25.670", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/446fe8ce699ce0a4d702f7b0fcdb50de340b9260"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7ce2b00ff058ec4cafc9b447e1f0a6d6f49275d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8eed5519e496b7a07f441a0f579cb228a33189f7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"created": "2026-08-15T19:00:03.258214+00:00", "updated": "2026-08-15T19:00:03.258228+00:00", "vendors": [], "weaknesses": ["CWE-419", "CWE-668"]}