{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()  syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.  When device registration fails (e.g. in register_netdevice()), netdev core unwinds by sending a single NETDEV_UNREGISTER notification. If work was queued during NETDEV_REGISTER (utn-\u003ework_pending is set), udp_tunnel_nic_unregister() returns early:  \tif (utn-\u003ework_pending) \t\treturn;  Because failed registrations do not enter netdev_wait_allrefs_any(), no subsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked permanently.  Fix this by removing the early return. Instead, synchronously cancel any pending work with cancel_delayed_work_sync() before freeing @utn.  To be able to call cancel_delayed_work_sync() while holding RTNL (the work also needs RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queue_delayed_work()) to prevent high CPU contention while waiting for RTNL lock.  The utn-\u003ework_pending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work.  [1] BUG: memory leak unreferenced object 0xffff888127d5f840 (size 96):   comm \"syz-executor\", pid 5806, jiffies 4294942188   backtrace (crc 99fdb6c8):     __kmalloc_noprof+0x3bf/0x550     udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]     udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]     udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931     notifier_call_chain+0x59/0x160 kernel/notifier.c:85     call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250     register_netdevice+0xc10/0xeb0 net/core/dev.c:11478",
  "id": "DEBIAN-CVE-2026-74543",
  "modified": "2026-09-19T21:47:34.566837627Z",
  "published": "2026-08-15T13:17:59.643Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74543"
    }
  ],
  "upstream": [
    "CVE-2026-74543"
  ]
}