CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs

CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: pfcp: allocate per-cpu tstats for PFCP netdevs

PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but
pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS.  The net
core therefore leaves dev->tstats NULL for PFCP devices.

Creating a PFCP rtnetlink device can immediately ask the new netdev for
stats while building the RTM_NEWLINK notification.  That reaches
dev_get_tstats64() and dereferences the NULL dev->tstats pointer.

Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so
the net core allocates the storage expected by dev_get_tstats64().

The Linux kernel CVE team has assigned CVE-2026-74286 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.12.97 with commit 56b4ad500fd1282ef04db3c4beae5b54ab093a53
	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 6.18.40 with commit 51a1d9836acc76a1bd16170b2f4b35f11036593f
	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 7.1.5 with commit 67e4b283de36d9eebf95acdea5d6674b6ef4b2f4
	Issue introduced in 6.10 with commit 76c8764ef36a5d37ea2e551bda28ac7f028383ba and fixed in 7.2-rc1 with commit 24041543da8cd84eb5d8ae738c534372fff54820

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74286
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/pfcp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/56b4ad500fd1282ef04db3c4beae5b54ab093a53
	https://git.kernel.org/stable/c/51a1d9836acc76a1bd16170b2f4b35f11036593f
	https://git.kernel.org/stable/c/67e4b283de36d9eebf95acdea5d6674b6ef4b2f4
	https://git.kernel.org/stable/c/24041543da8cd84eb5d8ae738c534372fff54820