CVE-2026-97410: netconsole: take target_cleanup_list_lock in drop_netconsole_target()

CVE-2026-97410: netconsole: take target_cleanup_list_lock in drop_netconsole_target()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netconsole: take target_cleanup_list_lock in drop_netconsole_target()

drop_netconsole_target() unlinks the target while only holding
target_list_lock. However, when the underlying interface has been
unregistered, netconsole_netdev_event() moves the target from
target_list to target_cleanup_list, and netconsole_process_cleanups_core()
walks that list under target_cleanup_list_lock only.

If a user removes the configfs target at the same time the cleanup
worker is iterating target_cleanup_list, list_del() can corrupt the list
because the two paths take disjoint locks while operating on the same
list node.

Acquire target_cleanup_list_lock around the list_del() so the unlink is
serialised against netconsole_process_cleanups_core() regardless of
which list the target currently belongs to. The state transition that
downgrades STATE_DEACTIVATED to STATE_DISABLED is left intact and is
performed under the same combined locking, preserving the existing
ordering with resume_target().

The Linux kernel CVE team has assigned CVE-2026-97410 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.12.111 with commit 84592ee22f7d1583ce33aa733411ff36c7a1c44c
	Fixed in 6.18.53 with commit fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007
	Fixed in 7.2 with commit 91aeb87f052367a5a2743cc93777dfb4386f2f14

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-97410
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/netconsole.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/84592ee22f7d1583ce33aa733411ff36c7a1c44c
	https://git.kernel.org/stable/c/fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007
	https://git.kernel.org/stable/c/91aeb87f052367a5a2743cc93777dfb4386f2f14