CVE-2026-23192: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23192 is a use-after-free (UAF) vulnerability in the Linux kernel's linkwatch subsystem. It occurs when linkwatch_do_dev() releases a device reference via __dev_put(), potentially allowing netdev_run_todo() to free the device via kobject_put() before __linkwatch_run_queue() finishes accessing it — resulting in a UAF when netdev_unlock_ops() operates on the already-freed device structure. The vulnerability was published on February 14, 2026, and affects Linux kernel versions 6.15.1 through 6.18.9, as well as 6.15 and 6.19 release candidates. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is a use-after-free condition (CWE-416) in the Linux kernel's linkwatch subsystem. When linkwatch_do_dev() calls __dev_put() to release the linkwatch reference, the device refcount may drop to 1; at that point, netdev_run_todo() can proceed — since linkwatch_sync_dev() sees an empty list and returns without blocking — wait for the refcount to reach 1 via netdev_wait_allrefs_any(), and then free the device via kobject_put(). This creates a race condition where __linkwatch_run_queue() subsequently calls netdev_unlock_ops() on the already-freed device. The attack vector is local, requires low privileges, and no user interaction, making it exploitable by any user with access to network device management operations such as TUN/TAP device creation (Feedly, Kernel Patch 1).

Successful exploitation can lead to kernel memory corruption, denial of service (system crash), or potential local privilege escalation. An attacker with low-privilege local access can trigger the vulnerability through routine network device operations — such as bringing interfaces up/down, changing carrier status, or adding/removing TUN/TAP devices — without requiring elevated privileges beyond those needed for network device management. The vulnerability's scope is limited to the local system, but kernel-level memory corruption could enable an attacker to escalate to root or destabilize the host (Feedly).

1. Gain local access: Obtain a low-privilege local user account on a system running a vulnerable Linux kernel version (6.15.1–6.18.9, or 6.15/6.19 release candidates).
2. Identify network device management capability: Confirm access to TUN/TAP device creation, e.g., via ip tuntap add mode tun name tun0 (typically requires CAP_NET_ADMIN or equivalent).
3. Trigger the race condition: Rapidly create and delete TUN/TAP network interfaces in a loop to force concurrent execution of linkwatch_do_dev() and netdev_run_todo(), creating the window for the UAF.
4. Exploit the UAF: Time the interface teardown so that __dev_put() drops the refcount to 1 while __linkwatch_run_queue() is still processing, causing netdev_run_todo() to free the device structure via kobject_put() before netdev_unlock_ops() completes.
5. Achieve impact: Depending on heap layout and timing, the freed memory may be reallocated and corrupted, potentially leading to a kernel panic (DoS) or controlled memory write enabling privilege escalation (Feedly).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg referencing linkwatch, netdev_unlock_ops, or kobject_put with use-after-free indicators (e.g., KASAN: use-after-free or slab-use-after-free).
• Process: Unusual or rapid creation/deletion of TUN/TAP network interfaces by non-root processes; repeated ip tuntap or tunctl invocations in process audit logs.
• Network: Unexpected appearance and disappearance of network interfaces (e.g., tun0, tap0) visible in ip link output or system logs.
• System Stability: Unexpected kernel panics or system reboots on hosts performing dynamic network device operations, particularly in virtualized or container environments (Feedly).

The fix is available in Linux kernel version 6.18.10 and later, via two upstream commits that move __dev_put() from linkwatch_do_dev() to its callers, ensuring device references are released only after all device accesses are complete. Organizations running affected versions (6.15.1 through 6.18.9, or 6.15/6.19 release candidates) should prioritize upgrading to kernel 6.18.10 or a later stable release. As a temporary workaround, restricting access to CAP_NET_ADMIN (e.g., limiting TUN/TAP device creation to trusted users) can reduce the attack surface until patching is feasible (Feedly, Kernel Patch 1, Kernel Patch 2).

Coverage has been limited to automated vulnerability tracking platforms including Vulners, VulDB, CVEFeed, and Tenable's Nessus plugin database (plugin ID 299108). A brief technical summary was published by infinitsec.net shortly after disclosure. No notable researcher commentary, vendor statements beyond the kernel patch, or significant social media discussion has been identified (Feedly).