---
id: CVE-2026-72405
title: 'net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync

  Yue Sun reported a use-after-free and debugobjects warning in
  udp_tunnel_nic_device_sync_work() …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 <
    cee6688e5731c0591643521716d1a1a5c1a98bf8
  - >-
    Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 <
    9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7
  - >-
    Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 <
    54292b167466cdf42176b7b6f01da66c184deb12
  - >-
    Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 <
    ecf69d4b43370c587e48d4d70289dbdb7e039d4d
  - Linux 5.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:49:07.638343Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:21.945Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72405'
references:
  - url: 'https://git.kernel.org/stable/c/cee6688e5731c0591643521716d1a1a5c1a98bf8'
  - url: 'https://git.kernel.org/stable/c/9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7'
  - url: 'https://git.kernel.org/stable/c/54292b167466cdf42176b7b6f01da66c184deb12'
  - url: 'https://git.kernel.org/stable/c/ecf69d4b43370c587e48d4d70289dbdb7e039d4d'
tags:
  - cve.org
epss: 0.0017
epssPercentile: 0.05952
ingestedAt: '2026-10-16T19:46:24.399Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync

Yue Sun reported a use-after-free and debugobjects warning in
udp_tunnel_nic_device_sync_work() during concurrent device operations.

The workqueue core clears the internal pending bit before invoking the
worker. At that point, a concurrent thread can queue the work again.
When the already running worker eventually clears the work_pending flag
to 0, it mistakenly clears the flag for the newly queued instance.
udp_tunnel_nic_unregister() then observes work_pending as 0 and frees
the structure while the second work item is still active in the queue,
leading to UAF.

Fix this by returning early in udp_tunnel_nic_device_sync() if
work_pending is already set, preventing redundant work queueing.

## Affected

- `Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 < cee6688e5731c0591643521716d1a1a5c1a98bf8`
- `Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 < 9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7`
- `Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 < 54292b167466cdf42176b7b6f01da66c184deb12`
- `Linux >= cc4e3835eff474aa274d6e1d18f69d9d296d3b76 < ecf69d4b43370c587e48d4d70289dbdb7e039d4d`
- `Linux 5.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.