CVE-2026-90135 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
sashiko is reporting that trying to read /sys/kernel/debug/ref_tracker/* causes use-afer-free crash when either alloc_percpu() or dev_addr_init() in alloc_netdev_mqs() failed, for commit 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") added ref_tracker_dir_exit() to only free_netdev() path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel networking subsystem contains a critical resource management flaw within the alloc_netdev_mqs function, which is responsible for allocating and initializing network devices with multiple queues. This vulnerability arises from an incomplete implementation of reference tracking infrastructure cleanup during error handling paths. Specifically, when the allocation of per-CPU data structures via alloc_percpu or the initialization of device addresses through dev_addr_init fails within this routine, the kernel proceeds to return without invoking ref_tracker_dir_exit(). While a previous commit introduced reference tracker directory exit calls into the free_netdev path for successful allocations, it failed to account for early exits caused by allocation failures. This oversight results in allocated tracking resources remaining active despite the network device structure being abandoned or partially initialized, creating a state where subsequent access to debug interfaces can trigger use-after-free conditions as the kernel attempts to interact with memory that has been effectively orphaned from proper lifecycle management.
The operational impact of this vulnerability is significant for systems relying on dynamic network interface creation and debugging tools. Attackers or malicious users with local access who can trigger repeated allocation failures, such as through resource exhaustion attacks or specific ioctl calls, may induce kernel panics by reading from /sys/kernel/debug/ref_tracker directories. These debug interfaces expose internal reference tracking data structures that rely on the assumption that all allocated trackers are properly paired with corresponding exit routines. When ref_tracker_dir_exit is skipped due to early function return, the tracker directory remains registered in global lists while its underlying memory may be freed or left in an inconsistent state. This discrepancy allows for potential denial of service through kernel crashes and creates opportunities for more sophisticated exploitation if the use-after-free condition can be leveraged to achieve arbitrary code execution, although the primary observed effect is system instability.
From a vulnerability classification perspective, this issue aligns with CWE-416 Use After Free, as it involves accessing memory or data structures after they have been made available for reuse without proper synchronization or cleanup. Additionally, it relates to CWE-755 Improper Handling of Exceptional Conditions because the error handling path fails to perform necessary resource deallocation steps that are standard in successful execution paths. In terms of ATT&CK mapping, this vulnerability facilitates local privilege escalation vectors by allowing a low-privileged user to crash the kernel or potentially manipulate memory states through debug filesystem interactions, which falls under techniques related to system discovery and potential defense evasion if used to obscure malicious activity via system instability.
Mitigation strategies primarily involve applying vendor-provided kernel patches that correct the alloc_netdev_mqs function to ensure ref_tracker_dir_exit is called in all exit paths, including those triggered by allocation failures. System administrators should monitor for updates from their distribution vendors and apply security errata promptly. For environments where immediate patching is not feasible, restricting access to /sys/kernel/debug/ref_tracker directories can reduce the attack surface by preventing unprivileged users from triggering the use-after-free condition through debug interface reads. Furthermore, implementing strict resource limits on network device creation via cgroups or sysctl parameters may help mitigate denial of service attempts that exploit allocation failures leading to this vulnerability state.