CVE-2026-72405

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) issue exists in the udp tunnel nic device sync work() function during concurrent device operations. The issue occurs because the workqueue core clears the internal pending bit before invoking the worker, allowing a concurrent thread to queue the work again. When the active worker clears the work pending flag, it inadvertently clears the flag for the newly queued instance. Consequently, the udp tunnel nic unregister() function may free the structure while a second work item remains active in the queue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.