CVE-2026-64424 Overview
CVE-2026-64424 is a use-after-free vulnerability in the Linux kernel's netpoll subsystem. The flaw occurs on the shutdown path when a pending TX worker runs in parallel with the cleanup routine. Kernel Address Sanitizer (KASAN) detects a slab-use-after-free in _raw_spin_lock_irqsave triggered from skb_dequeue inside queue_process. The root cause is that rcu_cleanup_netpoll_info() invokes cancel_delayed_work() without waiting for in-flight workers, then frees the npinfo structure. Because queue_process() is not an RCU reader and reaches npinfo through container_of() on the work item, it may dereference freed memory. The fix uses disable_delayed_work_sync() to fully stop the worker and prevent re-arming.
Critical Impact
A use-after-free in kernel network polling can cause memory corruption, kernel crashes, or potentially privilege escalation on systems where netpoll is enabled.
Affected Products
- Linux kernel (netpoll subsystem)
- Distributions shipping affected upstream kernels prior to the referenced stable patches
- Systems using netconsole or other netpoll consumers
Discovery Timeline
- 2026-07-25 - CVE-2026-64424 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64424
Vulnerability Analysis
The vulnerability resides in the netpoll shutdown sequence. When __netpoll_cleanup() runs, it sets dev->npinfo to NULL, schedules rcu_cleanup_netpoll_info() via call_rcu(), and eventually calls kfree(npinfo). Inside the RCU callback, the code attempts to cancel outstanding delayed work using cancel_delayed_work() because it executes in softirq context and cannot use the synchronous variant. This non-synchronous cancel does not wait for currently executing workers.
As a result, the queue_process() worker can continue running after npinfo has been freed. The worker calls skb_dequeue() on a queue owned by the freed structure and then attempts _raw_spin_lock_irqsave() on freed memory, triggering the KASAN report.
Root Cause
The root cause is an incorrect assumption that RCU grace periods and cancel_delayed_work() are sufficient to synchronize with the queue_process worker [CWE-416]. The worker reaches npinfo through container_of() on its embedded work item rather than through an RCU-protected pointer, so RCU semantics do not protect it. The upstream fix replaces cancel_delayed_work() with disable_delayed_work_sync(), which both waits for the worker to finish and prevents future re-arming attempts.
Attack Vector
Triggering the race requires the ability to bring netpoll interfaces down while TX work is in flight. On systems with netconsole or similar netpoll consumers, a local user with sufficient privileges to toggle netpoll state through sysfs (for example, enabled_store) may induce the race. Successful exploitation leads to reads or writes against freed slab memory, which can escalate to kernel memory corruption. Refer to the upstream commits 45f1458, 5ed09a1, 95ecc5b, and a33f37f for the exact fix locations.
Exploitation code is not published. The vulnerability manifests only when a delayed TX worker executes between the RCU callback's cancel attempt and subsequent kfree(). See the Linux Kernel Commit 45f1458 for the authoritative patch.
Detection Methods for CVE-2026-64424
Indicators of Compromise
- KASAN reports naming slab-use-after-free in _raw_spin_lock_irqsave with a call trace including skb_dequeue, queue_process, and worker_thread
- Unexpected kernel oops or panic during netpoll teardown, netconsole disable, or interface removal
- Workqueue backtraces referencing queue_process after a netpoll consumer was disabled
Detection Strategies
- Enable KASAN on test and pre-production kernels to catch the use-after-free deterministically
- Monitor kernel logs (dmesg, journalctl -k) for BUG: KASAN entries tied to the netpoll code path
- Compare running kernel versions against the fixed stable commits 45f1458, 5ed09a1, 95ecc5b, and a33f37f
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on KASAN, Oops, or general protection fault strings
- Track sysfs writes to netpoll-related paths such as /sys/kernel/config/netconsole/*/enabled to correlate crashes with configuration changes
- Baseline kernel package versions across the fleet and flag hosts still running unpatched builds
How to Mitigate CVE-2026-64424
Immediate Actions Required
- Apply the stable kernel updates that include commits 45f1458a8501, 5ed09a108d93, 95ecc5b58042, and a33f37f8d079
- Reboot affected systems after upgrading the kernel package to activate the fix
- Restrict privileged access that permits toggling netpoll or netconsole state on production hosts
Patch Information
The upstream fix replaces cancel_delayed_work() with disable_delayed_work_sync() in the netpoll cleanup path, ensuring the TX worker is fully stopped before npinfo is freed. Distribution vendors will ship the fix through standard stable-tree backports. Reference the following patches: Linux Kernel Commit 45f1458, Linux Kernel Commit 5ed09a1, Linux Kernel Commit 95ecc5b, and Linux Kernel Commit a33f37f.
Workarounds
- Disable netconsole and other netpoll consumers on hosts that do not require them
- Avoid dynamically toggling netpoll state during production operations until the patch is applied
- Limit sysfs write permissions on netpoll configuration entries to reduce local trigger paths
# Verify netconsole is not loaded and prevent auto-load until patched
lsmod | grep -i netconsole
echo 'blacklist netconsole' | sudo tee /etc/modprobe.d/blacklist-netconsole.conf
sudo update-initramfs -u
# Confirm running kernel version against fixed stable release
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
