Use-after-free Vulnerability in Linux Kernel Affecting Octeon Product

CVE-2026-93279

What is CVE-2026-93279?

A use-after-free vulnerability has been identified in the Octeon product within the Linux kernel. The issue arises from the improper cleanup of the TX cleanup tasklet during device removal. If the watchdog IRQ handler triggers cleanup, it could inadvertently execute the tasklet even after the network device structures have been freed. The threat involves potential access to freed memory areas, which may lead to unexpected behavior or system crashes. A fix has been implemented by adding a tasklet_kill() call following free_irq(), ensuring that the tasklet does not run post-teardown, thereby enhancing the security of affected systems.

References