CVE-2026-72493

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists during device unregistration, such as during a network namespace exit, where packets can bypass backlog flushing. This occurs because a lockless netif running() check in the enqueue to backlog() function creates a TOCTOU (Time-of-Check to Time-of-Use) race window. A lockless transmitter, such as veth xmit, may pass the check before dev close() clears the IFF UP flag. If the transmitter is delayed, flush all backlogs() may complete before the transmitter acquires the backlog lock and queues the packet. Consequently, the packet escapes the flush and triggers a KASAN slab-use-after-free (UAF) in the fib rules lookup() function when processed. A slab-use-after-free is a memory corruption issue where a program continues to use a pointer after the memory it points to has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.