Linux Kernel CVE-2026-74264

Exploitation requires local system access with at least low-privilege credentials (CVSS PR:L). The attacker must be able to cause concurrent execution of netdev_watchdog_up() and the dev_watchdog() timer callback - achievable by triggering rapid carrier-state change events on a network interface (e.g., repeatedly bringing an interface up and down or simulating link flaps) while the watchdog timer is active. On systems where unprivileged users cannot manipulate network interface state - enforced via CAP_NET_ADMIN restrictions, SELinux, or AppArmor - the precondition cannot be met. The race is timing-dependent and not guaranteed to trigger on every attempt, which limits reliability. Systems where only a single process context touches the watchdog code (single-interface, low-churn environments) have substantially reduced exposure. Remote exploitation is not possible; this is strictly a local-access vulnerability.

The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L) reflects worst-case kernel memory corruption potential, but the demonstrated impact from the syzbot crash trace is a kernel panic - primarily a denial-of-service outcome. The C:H/I:H components in the NVD vector are aspirational: kernel list corruption can theoretically be leveraged for privilege escalation in some scenarios, but no such exploit has been demonstrated or confirmed for this specific flaw. EPSS at 0.20% (10th percentile) independently corroborates that exploitation probability is very low in practice. The vulnerability is not listed in CISA KEV, and no public POC has been identified. The syzbot reporter is Google's automated kernel fuzzer, meaning this was a fuzzer-discovered crash rather than a targeted researcher finding. Even a mid-sized municipal IT team in walbrzych running Linux servers on public infrastructure should treat a pending kernel patch as routine maintenance rather than emergency response, given the local-only vector and the absence of any weaponized exploit. The primary realistic threat is an unprivileged local user deliberately crashing a shared system - a meaningful risk in multi-tenant or containerized environments but lower priority for single-tenant hosts.

A local user with standard unprivileged access on a multi-user Linux system (e.g., a shared server or container host) writes a program that rapidly toggles the carrier state of a network interface - triggering repeated linkwatch events - while the kernel's dev_watchdog() timer fires concurrently. If the race window between netdev_watchdog_up() and the timer callback is won, the watchdog_dev_tracker pointer is corrupted, the ref_tracker_free() call invokes list_del on an already-freed or overwritten list node, and the kernel emits a list_del corruption BUG followed by an Oops, crashing the system or the affected CPU. No public POC code has been identified; the crash was reproduced by the syzbot automated fuzzer.