Linux Kernel CVE-2026-72405

Exploitation requires local authenticated access with at least unprivileged user credentials (CVSS PR:L confirmed). The target system must have a NIC with UDP tunnel offload support active and in use - specifically, the udp_tunnel_nic subsystem must be loaded and processing tunnel registrations/deregistrations concurrently. This is typical in systems running VXLAN or GENEVE-based overlay networking, such as Kubernetes nodes with certain CNI plugins, QEMU/KVM hypervisors using virtio NIC offload, or OVS-DPDK deployments. The race is not triggerable on systems where UDP tunnel NIC offload is absent or disabled. Limiting factors: the race window requires concurrent device sync events, making reliable exploitation dependent on workload characteristics and timing; exploitation is further limited by kernel mitigations such as SLAB_FREELIST_RANDOM and KASLR on modern distributions.

CVSS 7.8 HIGH with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects serious local impact but bounded attack surface - exploitation requires physical or shell-level access with at least unprivileged user credentials. EPSS at 0.18% (7th percentile) confirms no current mass exploitation trend and aligns with the absence of a CISA KEV listing. Race-condition UAFs in kernel workqueues are notoriously difficult to weaponize reliably in practice despite AC:L scoring; the low complexity rating reflects that no special bypass is needed once local access and the target workload (UDP tunnel NIC) are present, not that timing is trivial. For systems running UDP tunnel workloads (container networking, cloud hypervisors, VPN concentrators using NIC offload), this is a credible local privilege escalation path and should be prioritized for patching. For systems not using UDP tunnel NIC offloading, real-world risk is substantially reduced. Overall: real priority for kernel-dependent infrastructure, lower urgency for desktop or non-tunnel workloads.

An unprivileged local user on a server running container networking or cloud hypervisor UDP tunnel workloads (VXLAN/GENEVE with NIC offload enabled) spawns concurrent threads that repeatedly trigger device sync operations on the tunnel NIC. The race between the workqueue's internal pending bit and the driver's work_pending flag causes the structure to be freed while a second work item is still queued, giving the attacker a use-after-free primitive in kernel memory that can be leveraged for privilege escalation to root. No public proof-of-concept code has been identified at time of analysis, making opportunistic exploitation unlikely in the near term.