CVE-2026-74543 - Vulnerability Details

- net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

Description

In the Linux kernel, the following vulnerability has been resolved:

net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.

When device registration fails (e.g. in register_netdevice()), netdev core
unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued
during NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister()
returns early:

if (utn->work_pending)
return;

Because failed registrations do not enter netdev_wait_allrefs_any(), no
subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the
struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked
permanently.

Fix this by removing the early return. Instead, synchronously cancel any
pending work with cancel_delayed_work_sync() before freeing @utn.

To be able to call cancel_delayed_work_sync() while holding RTNL (the work also
needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL
is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work())
to prevent high CPU contention while waiting for RTNL lock.

The utn->work_pending bookkeeping is no longer needed and is removed, as
the workqueue core already tracks the pending/running state of the work.

[1]
BUG: memory leak
unreferenced object 0xffff888127d5f840 (size 96):
comm "syz-executor", pid 5806, jiffies 4294942188
backtrace (crc 99fdb6c8):
__kmalloc_noprof+0x3bf/0x550
udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]
udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x59/0x160 kernel/notifier.c:85
call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250
register_netdevice+0xc10/0xeb0 net/core/dev.c:11478

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a memory leak in the UDP tunnel NIC offload code because work queued during registration is not cancelled when the driver fails to register. This results in the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() being leaked permanently, causing successive failed registrations to progressively consume kernel memory. Based on the description, it is inferred that an attacker would need the ability to trigger repeated device registration failures — i.e., local privileged or compromised local user capable of creating or reconfiguring a UDP tunnel NIC device.

Affected Systems

Linux kernel releases that include the UDP tunnel NIC implementation and have not yet integrated the fix found in commit 080695e6f005e2396f1207fd69d24c442cb230c6. The affected component is net/ipv4/udp_tunnel_nic.c and the vulnerability applies to every distribution that ships with this driver enabled, regardless of vendor.

Risk and Exploitability

The vulnerability is not listed in the CISA KEV catalog and has a CVSS score of 5.5, denoting moderate severity. The EPSS score is <1%, indicating a very low probability that the vulnerability will be exploited in the near term. No exploit code is currently known, so the risk is primarily that a privileged or compromised local user could repeatedly initiate failed device registrations, causing a kernel memory leak that might gradually increase memory usage. The attack likely requires local privilege or the ability to trigger UDP tunnel NIC device registration failures; the potential impact is a local increase in kernel memory consumption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cc4e3835eff474aa274d6e1d18f69d9d296d3b76`	affected	< b712da45bd9b9835d132e9fbc0c3e43c164cb1fd
`cc4e3835eff474aa274d6e1d18f69d9d296d3b76`	affected	< f82a2ded3d7a9098267c84f14eafdb98c4550ac5
`cc4e3835eff474aa274d6e1d18f69d9d296d3b76`	affected	< b322532a4b774db1b480a2de84125910a70739a5
`cc4e3835eff474aa274d6e1d18f69d9d296d3b76`	affected	< 080695e6f005e2396f1207fd69d24c442cb230c6

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cc4e3835eff474aa274d6e1d18f69d9d296d3b76,b712da45bd9b9835d132e9fbc0c3e43c164cb1fd)`	affected	code_commit	—
`[cc4e3835eff474aa274d6e1d18f69d9d296d3b76,f82a2ded3d7a9098267c84f14eafdb98c4550ac5)`	affected	code_commit	—
`[cc4e3835eff474aa274d6e1d18f69d9d296d3b76,b322532a4b774db1b480a2de84125910a70739a5)`	affected	code_commit	—
`[cc4e3835eff474aa274d6e1d18f69d9d296d3b76,080695e6f005e2396f1207fd69d24c442cb230c6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.9`	affected	generic	—
`[0,5.9)`	unaffected	generic	—
`[6.12.103,7.0.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a release that contains commit 080695e6f005e2396f1207fd69d24c442cb230c6 or later, which removes the early return and synchronously cancels pending work before freeing the structure.
If an immediate kernel upgrade is not feasible, recompile or configure the kernel with the UDP tunnel NIC driver disabled (e.g., set CONFIG_INET_UDP_TUNNEL to n before running make) or unload the module if it is built as a loadable module (modprobe -r udp_tunnel_nic).
Continuously monitor kernel memory usage (e.g., with vmstat, free, or system monitoring tools) and set alerts for unusual or persistent increases in memory consumption that could indicate an ongoing exploit.

Generated by OpenCVE AI on August 21, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/080695e6f005e2396f1207fd69d24c442cb230c6
https://git.kernel.org/stable/c/b322532a4b774db1b480a2de84125910a70739a5
https://git.kernel.org/stable/c/b712da45bd9b9835d132e9fbc0c3e43c164cb1fd
https://git.kernel.org/stable/c/f82a2ded3d7a9098267c84f14eafdb98c4550ac5
https://lore.kernel.org/linux-cve-announce/2026081549-CVE-2026-74543-8822@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74543
https://www.cve.org/CVERecord?id=CVE-2026-74543

History

Fri, 21 Aug 2026 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Fri, 21 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026081549-CVE-2026-74543-8822@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74543 https://www.cve.org/CVERecord?id=CVE-2026-74543
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 15 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() syzbot reported a memory leak [1] in the UDP tunnel NIC offload code. When device registration fails (e.g. in register_netdevice()), netdev core unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued during NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister() returns early: if (utn->work_pending) return; Because failed registrations do not enter netdev_wait_allrefs_any(), no subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked permanently. Fix this by removing the early return. Instead, synchronously cancel any pending work with cancel_delayed_work_sync() before freeing @utn. To be able to call cancel_delayed_work_sync() while holding RTNL (the work also needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work()) to prevent high CPU contention while waiting for RTNL lock. The utn->work_pending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work. [1] BUG: memory leak unreferenced object 0xffff888127d5f840 (size 96): comm "syz-executor", pid 5806, jiffies 4294942188 backtrace (crc 99fdb6c8): __kmalloc_noprof+0x3bf/0x550 udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline] udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline] udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931 notifier_call_chain+0x59/0x160 kernel/notifier.c:85 call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250 register_netdevice+0xc10/0xeb0 net/core/dev.c:11478
Title		net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/080695e6f005e2396f1207fd69d24c442cb230c6 https://git.kernel.org/stable/c/b322532a4b774db1b480a2de84125910a70739a5 https://git.kernel.org/stable/c/b712da45bd9b9835d132e9fbc0c3e43c164cb1fd https://git.kernel.org/stable/c/f82a2ded3d7a9098267c84f14eafdb98c4550ac5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:53.336Z

Updated: 2026-08-17T05:21:28.314Z

Reserved: 2026-08-15T05:44:03.914Z

Link: CVE-2026-74543

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:59.643

Modified: 2026-08-17T06:19:51.503

Link: CVE-2026-74543

Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74543 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-21T23:30:17Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object