CVE-2026-74543 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.
When device registration fails (e.g. in register_netdevice()), netdev core unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued during NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister() returns early:
if (utn->work_pending) return;
Because failed registrations do not enter netdev_wait_allrefs_any(), no subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked permanently.
Fix this by removing the early return. Instead, synchronously cancel any pending work with cancel_delayed_work_sync() before freeing @utn.
To be able to call cancel_delayed_work_sync() while holding RTNL (the work also needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work()) to prevent high CPU contention while waiting for RTNL lock.
The utn->work_pending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work.
[1]
BUG: memory leak unreferenced object 0xffff888127d5f840 (size 96): comm "syz-executor", pid 5806, jiffies 4294942188 backtrace (crc 99fdb6c8): __kmalloc_noprof+0x3bf/0x550 udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]
udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931 notifier_call_chain+0x59/0x160 kernel/notifier.c:85 call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250 register_netdevice+0xc10/0xeb0 net/core/dev.c:11478
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the Linux kernel's UDP tunnel NIC offload implementation, specifically in the udp_tunnel_nic_unregister() function where a memory leak occurs due to improper handling of work queue cleanup during failed device registration. This issue was identified through syzbot automated testing which revealed that when device registration fails in register_netdevice(), the netdev core performs an unwinding process by sending a single NETDEV_UNREGISTER notification. The flaw manifests when work has been queued during NETDEV_REGISTER and utn->work_pending is set, causing udp_tunnel_nic_unregister() to return early without properly cleaning up allocated resources. This creates a permanent memory leak as the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is never freed.
The operational impact of this vulnerability stems from the improper resource management during device registration failures, where the kernel fails to properly synchronize work queue operations with the network device cleanup process. When registration fails and no subsequent NETDEV_UNREGISTER rebroadcast occurs due to the early return, the allocated memory remains unreferenced and permanently leaked. This represents a classic memory leak pattern that can accumulate over time, potentially leading to system instability or performance degradation in systems heavily utilizing UDP tunneling functionality.
The fix implements a more robust cleanup mechanism by removing the early return in udp_tunnel_nic_unregister() and instead synchronously cancelling any pending work using cancel_delayed_work_sync() before freeing the utn structure. This approach ensures that all queued work is properly cancelled regardless of registration success or failure. To maintain proper locking semantics while holding RTNL locks, the implementation switches from direct locking to rtnl_trylock() in udp_tunnel_nic_device_sync_work(), with a fallback mechanism to requeue work with a 1 jiffy delay if RTNL contention occurs. This prevents high CPU contention and maintains system responsiveness during lock acquisition while ensuring proper resource cleanup.
This vulnerability aligns with CWE-401: "Improper Release of Memory Before Removing Last Reference" and relates to ATT&CK technique T1547.001: "Registry Run Keys / Startup Folder" through potential impact on system stability and resource exhaustion, though the specific implementation targets kernel memory management rather than user-level persistence mechanisms. The fix addresses fundamental race conditions in work queue cleanup and ensures proper synchronization between device registration states and memory allocation lifecycle management, thereby resolving a critical memory leak that could compromise long-running systems utilizing UDP tunneling features.
The technical implementation resolves the issue by eliminating the work_pending bookkeeping which was redundant since the workqueue core already tracks pending/running states. The solution maintains kernel locking requirements while preventing deadlocks through the use of trylock semantics and delayed requeuing mechanisms. This approach follows established kernel patterns for handling complex synchronization scenarios and ensures that all allocated resources are properly accounted for during both successful and failed registration paths, thereby maintaining system memory integrity and preventing resource exhaustion attacks that could leverage such memory leaks for denial-of-service conditions.