From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A589C37E5D5 for ; Sat, 15 Aug 2026 06:33:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775589; cv=none; b=G+kaEUEoJmYL3qlDkPrce52k8PT7pKDLwd4AUIYihvNTiE87B+FL+/SE+DTQiRJ/r6u9FeV0+R9NZFi1m4eNmWRBTa8rblmkVom8KfrS1knSgIuTY892H0Z+8zxdNxMI4HxENxEavCTo6Y3UIAGrVQjWDWSWDQW7m4ldJOCDF7k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775589; c=relaxed/simple; bh=2oZ7yq0kZDLU/jR+5Hpl/Lfji8WnaazX3xAKUkz8ngw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=d9nleJmYPf0aHEzmnhGT9v/dIyA1aabMx1Q7irAhJXjkGGZuI8DWxvoAswFRCxd4dUFCOrcBilsXsvDXbEsQThXYrDPbZjNT5JAaDUkdgq0zJW97LTQFAF+ns7rJbKuA+KMlPalmENDteCrxv5g5vp46aEIN1vtDPrir/VXboNg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=otwSPrVN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="otwSPrVN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C2C4B1F000E9; Sat, 15 Aug 2026 06:33:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775588; bh=Mtuhqz5UGI2w8Ku34JMKYVNxwC2QFhkIQqNqMN0s8qM=; h=From:To:Cc:Subject:Date:Reply-To; b=otwSPrVN7arOHCKI9xC+OShM+mIe81fIGuzt/HgH7kUSRZO9mDraYGovkcyb6iPsX V8VJtJ5wAmpV53+kdvuUbQj5N+1yaUoatEP+1JjkwGnCuRNbB7uo8lVMD6TRs81H5F mYIuuWYItlA1NAYnzAwdMoCLV6rScEcHHOSXY1ro= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs Date: Sat, 15 Aug 2026 15:10:13 +0900 Message-ID: <2026081547-CVE-2026-74286-08f8@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2757; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=PTOTLsNCyGyVJNZE91ReDGKkx2UQF3GBzUFxLQBN5e0=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNjOx6B9b8CA3Vf/ygakpNXehBo2lsV+Kj+3XM0h38v /jMC/DqiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIlIz2KYn/NwqdMBpTUuQhFB skYX+T5L3ds1jWEOn/IkNUELp2+Rd7O3PHHb1jJTlkMIAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net core therefore leaves dev->tstats NULL for PFCP devices. Creating a PFCP rtnetlink device can immediately ask the new netdev for stats while building the RTM_NEWLINK notification. That reaches dev_get_tstats64() and dereferences the NULL dev->tstats pointer. Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so the net core allocates the storage expected by dev_get_tstats64(). The Linux kernel CVE team has assigned CVE-2026-74286 to this issue. Affected and fixed versions =========================== Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.12.97 with commit 56b4ad500fd1282ef04db3c4beae5b54ab093a53 Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.18.40 with commit 51a1d9836acc76a1bd16170b2f4b35f11036593f Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 7.1.5 with commit 67e4b283de36d9eebf95acdea5d6674b6ef4b2f4 Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 7.2-rc1 with commit 24041543da8cd84eb5d8ae738c534372fff54820 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74286 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/pfcp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/56b4ad500fd1282ef04db3c4beae5b54ab093a53 https://git.kernel.org/stable/c/51a1d9836acc76a1bd16170b2f4b35f11036593f https://git.kernel.org/stable/c/67e4b283de36d9eebf95acdea5d6674b6ef4b2f4 https://git.kernel.org/stable/c/24041543da8cd84eb5d8ae738c534372fff54820