Critical Use-After-Free Vulnerability in Linux Kernel - CVE-2026-90135
Summary
DEBIAN-CVE-2026-90135: In the Linux kernel, the following vulnerability has been resolved: net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() sashiko is reporting that trying to read /sys/kernel/debug/ref_tracker/* causes use-afer-f... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is widely used in various environments, from servers to embedded systems. The kernel's networking subsystem is crucial for managing network devices and protocols. This vulnerability affects the kernel's ability to handle network device reference tracking, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the networking subsystem, specifically within the alloc_netdev_mqs() function. This issue arises when the system attempts to read from the /sys/kernel/debug/ref_tracker/* directory after a failure in either alloc_percpu() or dev_addr_init(). The vulnerability was introduced in commit 4d92b95ff2f9, which added the net device refcount tracker infrastructure but failed to properly manage resource deallocation, leading to potential crashes and system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid accessing the /sys/kernel/debug/ref_tracker/* directory until the system is updated with the patched kernel. This will help prevent potential crashes associated with the vulnerability.
Conclusion
CVE-2026-90135 is a critical vulnerability in the Linux kernel that can lead to serious system issues. Users are strongly advised to update their kernel to the latest patched version to ensure system stability and security. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for linux →
FAQ
CVE-2026-90135 is a use-after-free vulnerability in the Linux kernel's networking subsystem that can lead to system crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to system instability, crashes, and potential data loss.
Yes, a patched version of the Linux kernel is available. Users should update their systems to the latest version to mitigate the risk.
If immediate updates are not possible, avoid accessing the /sys/kernel/debug/ref_tracker/* directory as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
