CVE-2026-74264

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: watchdog: fix refcount tracking races

Blamed commit converted the untracked dev_hold()/dev_put() calls

in the watchdog code to use the tracked dev_hold_track()/dev_put_track()

(which were later renamed/interfaced to netdev_hold() and netdev_put()).

By introducing dev->watchdog_dev_tracker to store the

reference tracking information without adding synchronization

between netdev_watchdog_up() and dev_watchdog(), it enabled the

race condition where this pointer could be overwritten or freed

concurrently, leading to the list corruption crash syzbot reported:

list_del corruption, ffff888114a18c00->next is NULL

kernel BUG at lib/list_debug.c:52 !

Oops: invalid opcode: 0000 [#1] SMP KASAN PTI

CPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026

Workqueue: events_unbound linkwatch_event

RIP: 0010:__li

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References