Skip to main content

Linux Kernel EUVDEUVD-2026-59304

| CVE-2026-72405 HIGH
2026-08-15 Linux GHSA-w888-j23q-c78g
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local vector confirmed by workqueue race requiring local process execution; PR:L because unprivileged shell access suffices; AC:L because no bypass is required beyond triggering concurrent sync.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:06 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync

Yue Sun reported a use-after-free and debugobjects warning in udp_tunnel_nic_device_sync_work() during concurrent device operations.

The workqueue core clears the internal pending bit before invoking the worker. At that point, a concurrent thread can queue the work again. When the already running worker eventually clears the work_pending flag to 0, it mistakenly clears the flag for the newly queued instance. udp_tunnel_nic_unregister() then observes work_pending as 0 and frees the structure while the second work item is still active in the queue, leading to UAF.

Fix this by returning early in udp_tunnel_nic_device_sync() if work_pending is already set, preventing redundant work queueing.

AnalysisAI

Use-after-free in the Linux kernel's UDP tunnel NIC device sync workqueue allows a local low-privileged attacker to corrupt kernel memory during concurrent device operations, potentially achieving full kernel compromise. The flaw stems from a race condition between the workqueue subsystem's internal pending bit and the driver-level work_pending flag in udp_tunnel_nic_device_sync_work(), causing udp_tunnel_nic_unregister() to free the structure while a second work item is still queued and active. No public exploit identified at time of analysis, but patched versions are available across all active stable kernel branches.

Technical ContextAI

The affected subsystem is udp_tunnel_nic, introduced in Linux 5.9 (commit cc4e3835eff474aa274d6e1d18f69d9d296d3b76), which provides NIC hardware offloading for UDP tunnel protocols such as VXLAN and GENEVE. The vulnerability is a classic workqueue race: the workqueue core clears its internal pending bit before invoking the worker function, creating a window in which a concurrent thread can re-enqueue the work. When the already-running worker subsequently clears the driver's work_pending flag to 0 to permit future scheduling, it inadvertently invalidates the flag for the newly queued second instance. udp_tunnel_nic_unregister() reads work_pending as 0, concludes no work is pending, and frees the underlying structure - while the second work item remains live in the queue. This is a textbook CWE-416 Use-After-Free triggered via a CWE-362 concurrent execution race condition. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms all Linux kernel builds from the introduction commit are affected until the respective stable-branch fixes.

RemediationAI

Upgrade the Linux kernel to a fixed stable release: 6.12.97 or later for the 6.12 LTS branch, 6.18.40 or later for the 6.18 branch, 7.1.5 or later for the 7.1 branch, or any 7.2-rc1 or later mainline build. Fix commits are available at https://git.kernel.org/stable/c/cee6688e5731c0591643521716d1a1a5c1a98bf8, https://git.kernel.org/stable/c/9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7, https://git.kernel.org/stable/c/54292b167466cdf42176b7b6f01da66c184deb12, and https://git.kernel.org/stable/c/ecf69d4b43370c587e48d4d70289dbdb7e039d4d. If a kernel upgrade is not immediately feasible, reducing the attack surface by disabling UDP tunnel NIC hardware offload via ethtool (e.g., ethtool -K <iface> tx-udp_tnl-segmentation off) removes the code path that triggers the race; note this will increase CPU overhead for VXLAN/GENEVE tunnel processing and may degrade network throughput on high-traffic systems. Restricting local shell access to unprivileged users via namespace isolation or mandatory access control (SELinux/AppArmor) reduces exploitation opportunity but does not eliminate the vulnerability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59304 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy