wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.15 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit wg_netns_pre_exit() manually acquires rtnl_lock() inside the pernet .pre_exit callback. This causes a hung task when another thread holds rtnl_mutex - the cleanup_net workqueue (or the setup_net failure rollback path) blocks indefinitely in wg_netns_pre_exit() waiting to acquire the lock. Convert to .exit_rtnl, introduced in commit 7a60d91c690b ("net: Add ->exit_rtnl() hook to struct pernet_operations."), where the framework already holds RTNL and batches all callbacks under a single rtnl_lock()/rtnl_unlock() pair, eliminating the contention window. The rcu_assign_pointer(wg->creating_net, NULL) is safe to move from .pre_exit to .exit_rtnl (which runs after synchronize_rcu()) because all RCU readers of creating_net either use maybe_get_net() - which returns NULL for a dying namespace with zero refcount - or access net->user_ns which remains valid throughout the entire ops_undo_list sequence. [ Jason: added __net_exit and __read_mostly annotations that were missing. ]
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e
- https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841
- https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982
- https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f
- https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-25472
- GCVE · GCVE-0-2026-31579
CERT-FR advisories
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0861 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0831 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0697 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 6.18.24cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.14cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 7.0 < 7.0.1
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 707607db2193591b68c0e70f814133472c185b1e ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 9a9e69155b2091b8297afaf1533b8d68a3096841 ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 1c52ef00e391144334f10995985c2f256d4be982 ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < a1d0f6cbb962af29586e3e65a4bced1a5e39221f ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 60a25ef8dacb3566b1a8c4de00572a498e2a3bf9 ; affected 363cc6efdbb54bb06cd5034a69b41aae974a736f |
| Linux · Linux | affected 5.8 ; unaffected 0 < 5.8 ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.24 ≤ 6.18.* ; unaffected 6.19.14 ≤ 6.19.* ; unaffected 7.0.1 ≤ 7.0.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |