---
id: CVE-2026-74479
title: 'net: pktgen: fix proc entry use-after-free'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: pktgen: fix proc entry use-after-free

  pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.
  pktgen_remove_device() removes the same entry before
  …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    82ed3db9269cb61e3c15bad2f6e221efce90e1e0
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    577443530cb592d5782a1f79847411a9363a65c8
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    f85a58340b91f225de3299dfa782c6414098077c
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    4ef801b838d85c0ea5852c50667f7344ce3b6cd0
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    b006a5404470bd3eb2aa0425fc447183032047ef
  - >-
    Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 <
    817ff6efdb7f484ea547218e11e17d8e43daa3b4
  - Linux 2.6.22
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:57:37.706862Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:48.651Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74479'
references:
  - url: 'https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0'
  - url: 'https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4'
  - url: 'https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4'
  - url: 'https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8'
  - url: 'https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c'
  - url: 'https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0'
  - url: 'https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef'
  - url: 'https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02031
ingestedAt: '2026-10-16T19:46:24.355Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: pktgen: fix proc entry use-after-free

pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.
pktgen_remove_device() removes the same entry before
_rem_dev_from_if_list() takes that lock.

This allows the following interleaving:

  CPU 0 (NETDEV_CHANGENAME)       CPU 1 (kpktgend)
  if_lock(t)
  proc_remove(pkt_dev->entry)
                                  proc_remove(pkt_dev->entry)
  pkt_dev->entry = proc_create_data(...)
  if_unlock(t)

The kthread can pass the stale proc_dir_entry to proc_remove() after the
rename path has freed it. A reproducer with a widened race window reports:

  BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80
  Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67
  Call Trace:
   proc_remove+0x78/0x80
   pktgen_remove_device.isra.0+0x11c/0x4c0
   pktgen_thread_worker+0x1214/0x6bc0
   kthread+0x2c6/0x3b0
  Allocated by task 95:
   __proc_create+0x204/0x790
   proc_create_data+0x72/0xe0
   pktgen_thread_write+0xd61/0x1510
  Freed by task 28:
   kmem_cache_free+0xcb/0x3d0
   proc_free_inode+0x5b/0x80
   rcu_core+0x50a/0x1850
  The buggy address belongs to the object at ffff8881478fea00
   which belongs to the cache proc_dir_entry of size 192

Move proc_remove() into the if_lock-protected list removal helper. Keep it
before list_del_rcu() to preserve the ordering required by add_device().
The rename path must then finish replacing the entry before removal, or
it observes that the device is no longer on the list.

## Affected

- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < 82ed3db9269cb61e3c15bad2f6e221efce90e1e0`
- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4`
- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < 7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4`
- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < 577443530cb592d5782a1f79847411a9363a65c8`
- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < f85a58340b91f225de3299dfa782c6414098077c`
- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < 4ef801b838d85c0ea5852c50667f7344ce3b6cd0`
- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < b006a5404470bd3eb2aa0425fc447183032047ef`
- `Linux >= 39df232f1a9ba48d41c68ee7d4046756e709cf91 < 817ff6efdb7f484ea547218e11e17d8e43daa3b4`
- `Linux 2.6.22`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.