CVE-2026-72405

net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync

Yue Sun reported a use-after-free and debugobjects warning in udp_tunnel_nic_device_sync_work() during concurrent device operations.

The workqueue core clears the internal pending bit before invoking the worker. At that point, a concurrent thread can queue the work again. When the already running worker eventually clears the work_pending flag to 0, it mistakenly clears the flag for the newly queued instance. udp_tunnel_nic_unregister() then observes work_pending as 0 and frees the structure while the second work item is still active in the queue, leading to UAF.

Fix this by returning early in udp_tunnel_nic_device_sync() if work_pending is already set, preventing redundant work queueing.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before d59d3b19e1cd1a01a6db59705327387a30aed153Affected cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before f49ed02fd8c98da823fdd7b00d64a8cc1d1883acAffected cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before cee6688e5731c0591643521716d1a1a5c1a98bf8Affected cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before 9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7Affected cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before 54292b167466cdf42176b7b6f01da66c184deb12Affected cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before ecf69d4b43370c587e48d4d70289dbdb7e039d4dAffected
LinuxLinux	5.9Affected before 5.9Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before d59d3b19e1cd1a01a6db59705327387a30aed153Affected
cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before f49ed02fd8c98da823fdd7b00d64a8cc1d1883acAffected
cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before cee6688e5731c0591643521716d1a1a5c1a98bf8Affected
cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before 9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7Affected
cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before 54292b167466cdf42176b7b6f01da66c184deb12Affected
cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to before ecf69d4b43370c587e48d4d70289dbdb7e039d4dAffected

LinuxLinux

5.9Affected
before 5.9Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.