CVE-2026-74329 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
watchdog: unregister PM notifier on watchdog unregister
watchdog_register_device() registers wdd->pm_nb when WDOG_NO_PING_ON_SUSPEND is set, but watchdog_unregister_device() does not remove it. This leaves an embedded notifier block on the PM notifier chain after the watchdog device has been unregistered.
A later suspend/resume notification can then call watchdog_pm_notifier() with a stale watchdog_device pointer, or at minimum after wdd->wd_data has been cleared by watchdog_dev_unregister().
Unregister the PM notifier before tearing down the watchdog device.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability represents a critical resource management flaw in the Linux kernel's watchdog subsystem that can lead to system instability and potential security implications. The issue occurs when a watchdog device is registered with the WDOG_NO_PING_ON_SUSPEND flag, which triggers the registration of a power management notifier block within the watchdog structure. This notifier block remains active on the system's power management notification chain even after the watchdog device has been successfully unregistered, creating a dangling pointer scenario that can persist beyond the intended lifecycle of the device.
The technical flaw stems from an incomplete cleanup operation during the watchdog device teardown process. When watchdog_register_device() is called with WDOG_NO_PING_ON_SUSPEND set, it properly registers the wdd->pm_nb notifier block to receive power management events. However, watchdog_unregister_device() fails to invoke the corresponding unregister operation for this notifier block, leaving it registered in the system's power management framework. This creates a situation where subsequent power management notifications can attempt to reference a watchdog_device structure that has been partially or fully deallocated, leading to memory corruption and undefined behavior.
The operational impact of this vulnerability extends beyond simple resource leak scenarios into potential system crashes and data integrity issues. During system suspend/resume cycles, the stale notifier block continues to receive PM events and attempts to process them using a potentially invalid watchdog_device pointer. The watchdog_pm_notifier() function may be called with a wdd structure where wdd->wd_data has already been cleared by the watchdog_dev_unregister() operation, resulting in dereferencing freed memory or accessing uninitialized data structures. This scenario can manifest as kernel oops, system panics, or more subtle corruption that might not immediately crash the system but could lead to persistent instability.
This vulnerability aligns with CWE-457: Use of Uninitialized Variable and CWE-825: Expired Pointer Dereference, both of which are classified under the broader category of memory safety issues. The flaw also maps to ATT&CK technique T1490: Inhibit System Recovery, as it can potentially prevent proper system shutdown or restart operations by corrupting critical kernel subsystems. Additionally, it demonstrates characteristics consistent with improper resource management patterns that could be exploited in privilege escalation scenarios if an attacker can manipulate the timing of watchdog registration and unregistration operations.
The recommended mitigation involves implementing proper cleanup procedures within the watchdog_unregister_device() function to ensure that any registered power management notifier blocks are removed before the watchdog device structure is fully torn down. This requires adding a call to unregister_pm_notifier() for wdd->pm_nb immediately before or during the device teardown process, ensuring complete removal from all system notification chains and preventing any further callbacks to stale pointers. The fix should be integrated into the existing watchdog subsystem cleanup logic to maintain consistency with other resource management practices within the kernel's power management framework.