{
  "cveId": "CVE-2026-23192",
  "url": "https://patchblox.com/security/cve/CVE-2026-23192",
  "summary": "CVE-2026-23192 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23192 (version 6.18.10-1), released February 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  linkwatch: use __dev_put() in callers to prevent...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  linkwatch: use __dev_put() in callers to prevent UAF  After linkwatch_do_dev() calls __dev_put() to release the linkwatch reference, the device refcount may drop to 1. At this point, netdev_run_todo() can proceed (since linkwatch_sync_dev() sees an empty list and returns without blocking), wait for the refcount to become 1 via netdev_wait_allrefs_any(), and then free the device via kobject_put().  This creates a use-after-free when __linkwatch_run_queue() tries to call netdev_unlock_ops() on the already-freed device.  Note that adding netdev_lock_ops()/netdev_unlock_ops() pair in netdev_run_todo() before kobject_put() would not work, because netdev_lock_ops() is conditional - it only locks when netdev_need_ops_lock() returns true. If the device doesn\u0027t require ops_lock, linkwatch won\u0027t hold any lock, and netdev_run_todo() acquiring the lock won\u0027t provide synchronization.  Fix this by moving __dev_put() from linkwatch_do_dev() to its callers. The device reference logically pairs with de-listing the device, so it\u0027s reasonable for the caller that did the de-listing to release it. This allows placing __dev_put() after all device accesses are complete, preventing UAF.  The bug can be reproduced by adding mdelay(2000) after linkwatch_do_dev() in __linkwatch_run_queue(), then running:    ip tuntap add mode tun name tun_test   ip link set tun_test up   ip link set tun_test carrier off   ip link set tun_test carrier on   sleep 0.5   ip tuntap del mode tun name tun_test  KASAN report:   ==================================================================  BUG: KASAN: use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]  BUG: KASAN: use-after-free in netdev_unlock_ops include/net/netdev_lock.h:47 [inline]  BUG: KASAN: use-after-free in __linkwatch_run_queue\u002B0x865/0x8a0 net/core/link_watch.c:245  Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123   CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full)  Hardware name: QEMU Standard PC (Q35 \u002B ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014  Workqueue: events_unbound linkwatch_event  Call Trace:   \u003CTASK\u003E   __dump_stack lib/dump_stack.c:94 [inline]   dump_stack_lvl\u002B0x100/0x190 lib/dump_stack.c:120   print_address_description mm/kasan/report.c:378 [inline]   print_report\u002B0x156/0x4c9 mm/kasan/report.c:482   kasan_report\u002B0xdf/0x1a0 mm/kasan/report.c:595   netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]   netdev_unlock_ops include/net/netdev_lock.h:47 [inline]   __linkwatch_run_queue\u002B0x865/0x8a0 net/core/link_watch.c:245   linkwatch_event\u002B0x8f/0xc0 net/core/link_watch.c:304   process_one_work\u002B0x9c2/0x1840 kernel/workqueue.c:3257   process_scheduled_works kernel/workqueue.c:3340 [inline]   worker_thread\u002B0x5da/0xe40 kernel/workqueue.c:3421   kthread\u002B0x3b3/0x730 kernel/kthread.c:463   ret_from_fork\u002B0x754/0xaf0 arch/x86/kernel/process.c:158   ret_from_fork_asm\u002B0x1a/0x30 arch/x86/entry/entry_64.S:246   \u003C/TASK\u003E  ==================================================================",
  "published": "2026-02-14T17:15:57Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00145,
  "epssPercentile": 0.03764,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.10-1",
      "fix": "DEBIAN-CVE-2026-23192",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23192",
      "released": "2026-02-14T17:15:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}