CVE-2026-90113

CVE CVE-2026-90113EUVD EUVD-2026-81706Published 2026-09-17T16:06:20.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: netdevsim: update queue NAPI association on queue reset In netdevsim, receive queues (struct nsim_rq) embed their own struct napi_struct. When queue reset is performed (e.g. via queue_reset debugfs), nsim_queue_start() swaps in a newly allocated struct nsim_rq, and nsim_queue_mem_free() later deletes and frees the old one. However, nsim_queue_start() failed to update the queue-to-NAPI mapping via netif_queue_set_napi(). As a result, dev->_rx[idx].napi continued to point to the old NAPI struct. After the old queue was freed, a subsequent queue dump via Netlink (NETDEV_CMD_QUEUE_GET) triggered a KASAN slab-use-after-free read in nla_put_napi_id() when accessing rxq->napi->napi_id. Fix this by calling netif_queue_set_napi() in nsim_queue_start() to associate the new NAPI with the RX queue, and clear the association with netif_queue_set_napi(..., NULL) in nsim_del_napi() during teardown.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 5bc8e8dbef27b73bd7b6d1fd5108b4fd4c6d469f <07e98a4d5e9c292eae97c9cc5ab0937384e48492; patch: 6.18.52; patch: 7.3-rc1; patch: 0; patch: 7.2.6; 5bc8e8dbef27b73bd7b6d1fd5108b4fd4c6d469f <db038ac4dca0fa626199e9c297eddd8362be0550; 5bc8e8dbef27b73bd7b6d1fd5108b4fd4c6d469f <b8f32b0804b4bf0cba0ee0a093e3fd74f11d7166; 6.14

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.