CVE-2026-23192

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

linkwatch: use __dev_put() in callers to prevent UAF

After linkwatch_do_dev() calls __dev_put() to release the linkwatch

reference, the device refcount may drop to 1. At this point,

netdev_run_todo() can proceed (since linkwatch_sync_dev() sees an

empty list and returns without blocking), wait for the refcount to

become 1 via netdev_wait_allrefs_any(), and then free the device

via kobject_put().

This creates a use-after-free when __linkwatch_run_queue() tries to

call netdev_unlock_ops() on the already-freed device.

Note that adding netdev_lock_ops()/netdev_unlock_ops() pair in

netdev_run_todo() before kobject_put() would not work, because

netdev_lock_ops() is conditional - it only locks when

netdev_need_ops_lock() returns true. If the device doesn't require

ops_lock, linkwatch won't hold any lock, and netdev_run_todo()

acquiring the lock won't provide synchronization.

Fix this by moving __dev_put() from linkwatch_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References