CVE-2026-90135 PUBLISHED

net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()

Assigner: Linux
Reserved: 11.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()

sashiko is reporting that trying to read /sys/kernel/debug/ref_tracker/* causes use-afer-free crash when either alloc_percpu() or dev_addr_init() in alloc_netdev_mqs() failed, for commit 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") added ref_tracker_dir_exit() to only free_netdev() path.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 4d92b95ff2f95f13df9bad0b5a25a9f60e72758d to 2775bf36be7872834a7f8c0a0d9681a1a3e1cd4c (excl.)
  • affected from 4d92b95ff2f95f13df9bad0b5a25a9f60e72758d to 5fe03b5257095e2beef0bc79e1f068fbd09a24c7 (excl.)
  • affected from 4d92b95ff2f95f13df9bad0b5a25a9f60e72758d to 63ab05e8f9654aa100d366c0236399fda6ffaab1 (excl.)
  • affected from 4d92b95ff2f95f13df9bad0b5a25a9f60e72758d to 0b1c2af8a22c35cb099c735c2f63ea3ba757557d (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.17 is affected
  • unaffected from 0 to 5.17 (excl.)
  • unaffected from 6.12.110 to 6.12.* (incl.)
  • unaffected from 6.18.52 to 6.18.* (incl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References