Linux Kernel EUVD-2026-25472

The vulnerability resides in the WireGuard kernel driver (net/wireguard/device.c) within the pernet .pre_exit callback wg_netns_pre_exit(). This callback explicitly calls rtnl_lock() to serialize access while cleaning up WireGuard state during network namespace teardown. The problem is that the cleanup_net workqueue and setup_net failure rollback path may already hold rtnl_mutex, creating a lock-ordering deadlock that causes the kernel thread to hang indefinitely. The fix converts the callback to use the .exit_rtnl hook (introduced in kernel commit 7a60d91c690b), where the framework itself holds RTNL for all callbacks under a single rtnl_lock()/rtnl_unlock() pair, eliminating the contention window. The rcu_assign_pointer(wg->creating_net, NULL) call is safely relocated to .exit_rtnl because it runs after synchronize_rcu(), and all RCU readers either use maybe_get_net() (which returns NULL for a dying namespace) or access net->user_ns which remains valid throughout the operation. Although CWE-476 (Null Pointer Dereference) is tagged in metadata, the primary mechanism is lock contention producing a hung task; the CWE tag is likely secondary. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms the issue spans the entire upstream Linux kernel product line.