CVE-2026-74543

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.

When device registration fails (e.g. in register_netdevice()), netdev core

unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued

during NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister()

returns early:

if (utn->work_pending)

return;

Because failed registrations do not enter netdev_wait_allrefs_any(), no

subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the

struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked

permanently.

Fix this by removing the early return. Instead, synchronously cancel any

pending work with cancel_delayed_work_sync() before freeing @utn.

To be able to call cancel_delayed_work_sync() while holding RTNL (the work also

needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References