{"id":7470,"date":"2026-09-04T18:49:34","date_gmt":"2026-09-04T10:49:34","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74479"},"modified":"2026-09-04T18:49:34","modified_gmt":"2026-09-04T10:49:34","slug":"cve-2026-74479","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74479","title":{"rendered":"CVE-2026-74479 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: pktgen: fix proc entry use-after-free<\/p>\n<p>pktgen_change_name() replaces pkt_dev-&gt;entry while holding t-&gt;if_lock.<br \/>\npktgen_remove_device() removes the same entry before<br \/>\n_rem_dev_from_if_list() takes that lock.<\/p>\n<p>This allows the following interleaving:<\/p>\n<p>  CPU 0 (NETDEV_CHANGENAME)       CPU 1 (kpktgend)<br \/>\n  if_lock(t)<br \/>\n  proc_remove(pkt_dev-&gt;entry)<br \/>\n                                  proc_remove(pkt_dev-&gt;entry)<br \/>\n  pkt_dev-&gt;entry = proc_create_data(&#8230;)<br \/>\n  if_unlock(t)<\/p>\n<p>The kthread can pass the stale proc_dir_entry to proc_remove() after the<br \/>\nrename path has freed it. A reproducer with a widened race window reports:<\/p>\n<p>  BUG: KASAN: slab-use-after-free in proc_remove+0x78\/0x80<br \/>\n  Read of size 8 at addr ffff8881478fea70 by task kpktgend_0\/67<br \/>\n  Call Trace:<br \/>\n   proc_remove+0x78\/0x80<br \/>\n   pktgen_remove_device.isra.0+0x11c\/0x4c0<br \/>\n   pktgen_thread_worker+0x1214\/0x6bc0<br \/>\n   kthread+0x2c6\/0x3b0<br \/>\n  Allocated by task 95:<br \/>\n   __proc_create+0x204\/0x790<br \/>\n   proc_create_data+0x72\/0xe0<br \/>\n   pktgen_thread_write+0xd61\/0x1510<br \/>\n  Freed by task 28:<br \/>\n   kmem_cache_free+0xcb\/0x3d0<br \/>\n   proc_free_inode+0x5b\/0x80<br \/>\n   rcu_core+0x50a\/0x1850<br \/>\n  The buggy address belongs to the object at ffff8881478fea00<br \/>\n   which belongs to the cache proc_dir_entry of size 192<\/p>\n<p>Move proc_remove() into the if_lock-protected list removal helper. Keep it<br \/>\nbefore list_del_rcu() to preserve the ordering required by add_device().<br \/>\nThe rename path must then finish replacing the entry before removal, or<br \/>\nit observes that the device is no longer on the list.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: pktgen: fix proc entry use-after-free<\/p>\n<p>pktgen_change_name() replaces pkt_dev-&gt;entry while holding t-&gt;if_lock.<br \/>\npktgen_remove_de<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7470","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7470","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7470"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7470"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}