From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2162B4A3F1C for ; Thu, 24 Sep 2026 16:10:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790266260; cv=none; b=Soxr1jehtvDlmhBAiJuk9ovTG2c9foWGPv166Pih0FGNcAqsn7UyWtL27ebQtogrRdGQ7Eo20IzTC4C1kbrT/je4UQcTLMscdPhvSNljl7NnErXq2As401x65uP83pXDNAMptxAWcRrcp3G81oh/pJbpuj6EQspLRG0gQWfq3oI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790266260; c=relaxed/simple; bh=SiliKvJqMp3nDybK7Gs1KVtZslLVqctIkPr2lxd1jc4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pxPp7PbkSf/JDXwUWv+hyp8r0AukmwhAXlwg977cVlFDzziS/zXwqKdhmXUMNUgjFu2k6Cwv6Ok6Md6/3LmOvE0nnSAiQ6gtL3Er9WSpcxu+lYtTWXasUFaEVj78KkCxoZH1fKKWdzjn1IZZbU2vTNYT6CatPIQodzH2liZmZeg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZXl7/kMq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ZXl7/kMq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C9401F000FF; Thu, 24 Sep 2026 16:10:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790266259; bh=2OI6MN4YuiaZ9n+Ek3VXAMOW4LEKQ0NXQG/aQ37ztlY=; h=From:To:Cc:Subject:Date:Reply-To; b=ZXl7/kMq536CanEbX3J/Ma9lokqe2JO7JkRqzjE5NoOMbBq+L4jc39I9eAk2WmYWm NddI1iQaZBdNgCXqwUf0mWDZjP8QKIWl9aC8n38epjB0Pim3OFo1qUobsVp4irPQwg j2aFIqhFapG5bztbuYMJ5VVT1q43w3InyyOBuCWM= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-97410: netconsole: take target_cleanup_list_lock in drop_netconsole_target() Date: Thu, 24 Sep 2026 18:03:10 +0200 Message-ID: <2026092425-CVE-2026-97410-b695@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2695; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=E9hIImNQrgasmJLGdGipwbyKORkWj/oNkBZ8SKExODY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlbPSd+7BPZuj4qKu17p1LRDBb5jLhsvWs7o+bnNnXbm z6ze2TeEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABOZJcywYMWHeeyaIeJv5nGF ps7+1h2/ktV3L8OChZ/Cw47aWmyPk9sYsGgn97r9E3ZWAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: netconsole: take target_cleanup_list_lock in drop_netconsole_target() drop_netconsole_target() unlinks the target while only holding target_list_lock. However, when the underlying interface has been unregistered, netconsole_netdev_event() moves the target from target_list to target_cleanup_list, and netconsole_process_cleanups_core() walks that list under target_cleanup_list_lock only. If a user removes the configfs target at the same time the cleanup worker is iterating target_cleanup_list, list_del() can corrupt the list because the two paths take disjoint locks while operating on the same list node. Acquire target_cleanup_list_lock around the list_del() so the unlink is serialised against netconsole_process_cleanups_core() regardless of which list the target currently belongs to. The state transition that downgrades STATE_DEACTIVATED to STATE_DISABLED is left intact and is performed under the same combined locking, preserving the existing ordering with resume_target(). The Linux kernel CVE team has assigned CVE-2026-97410 to this issue. Affected and fixed versions =========================== Fixed in 6.12.111 with commit 84592ee22f7d1583ce33aa733411ff36c7a1c44c Fixed in 6.18.53 with commit fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007 Fixed in 7.2 with commit 91aeb87f052367a5a2743cc93777dfb4386f2f14 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-97410 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/netconsole.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/84592ee22f7d1583ce33aa733411ff36c7a1c44c https://git.kernel.org/stable/c/fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007 https://git.kernel.org/stable/c/91aeb87f052367a5a2743cc93777dfb4386f2f14