CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net core therefore leaves dev->tstats NULL for PFCP devices. Creating a PFCP rtnetlink device can immediately ask the new netdev for stats while building the RTM_NEWLINK notification. That reaches dev_get_tstats64() and dereferences the NULL dev->tstats pointer. Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so the net core allocates the storage expected by dev_get_tstats64().

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/24041543da8cd84eb5d8ae738c534372fff54820
https://git.kernel.org/stable/c/51a1d9836acc76a1bd16170b2f4b35f11036593f
https://git.kernel.org/stable/c/56b4ad500fd1282ef04db3c4beae5b54ab093a53
https://git.kernel.org/stable/c/67e4b283de36d9eebf95acdea5d6674b6ef4b2f4

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:22

Updated : 2026-08-17 06:19

NVD link : CVE-2026-74286

Mitre link : CVE-2026-74286

CVE.ORG link : CVE-2026-74286

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74286", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba", "lessThan": "56b4ad500fd1282ef04db3c4beae5b54ab093a53", "versionType": "git"}, {"status": "affected", "version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba", "lessThan": "51a1d9836acc76a1bd16170b2f4b35f11036593f", "versionType": "git"}, {"status": "affected", "version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba", "lessThan": "67e4b283de36d9eebf95acdea5d6674b6ef4b2f4", "versionType": "git"}, {"status": "affected", "version": "76c8764ef36a5d37ea2e551bda28ac7f028383ba", "lessThan": "24041543da8cd84eb5d8ae738c534372fff54820", "versionType": "git"}], "programFiles": ["drivers/net/pfcp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/pfcp.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:22:28.127", "references": [{"url": "https://git.kernel.org/stable/c/24041543da8cd84eb5d8ae738c534372fff54820", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/51a1d9836acc76a1bd16170b2f4b35f11036593f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/56b4ad500fd1282ef04db3c4beae5b54ab093a53", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/67e4b283de36d9eebf95acdea5d6674b6ef4b2f4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pfcp: allocate per-cpu tstats for PFCP netdevs\n\nPFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but\npfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net\ncore therefore leaves dev->tstats NULL for PFCP devices.\n\nCreating a PFCP rtnetlink device can immediately ask the new netdev for\nstats while building the RTM_NEWLINK notification. That reaches\ndev_get_tstats64() and dereferences the NULL dev->tstats pointer.\n\nSet pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so\nthe net core allocates the storage expected by dev_get_tstats64()."}], "lastModified": "2026-08-17T06:19:22.497", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}