CVE-2026-74543

A flaw was found in the Linux kernel's UDP tunnel network interface controller (NIC) offload code. When a device registration fails, the system may not properly unregister the NIC tunnel, leading to a permanent memory leak. This can result in resource exhaustion over time, potentially causing a Denial of Service (DoS) condition where the system becomes unresponsive or unstable.

A low impact memory leak was found in the Linux kernel's UDP tunnel NIC offload code. When network device registration fails, the netdev core unwinds by sending a single NETDEV_UNREGISTER notification; if work was queued during NETDEV_REGISTER, udp_tunnel_nic_unregister() returns early, and since failed registrations never receive a later NETDEV_UNREGISTER rebroadcast, the struct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked permanently. A local attacker with privileges to configure network devices (such as CAP_NET_ADMIN) who can cause network device registration to fail repeatedly could leak kernel memory on each attempt, potentially leading to resource exhaustion and a denial of service. There is no impact to confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 are not affected because the UDP tunnel NIC offload code that contains this flaw is not present in those releases. The fix is deferred for the affected Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS 2 kernel releases: the flaw is rated Low impact because triggering it requires local privileged access and specific registration-failure conditions, so the residual risk is limited to gradual local memory exhaustion. The CVSS:3.1 base score is 5.5 (Moderate); Red Hat assesses the overall impact as Low because of the local privileged prerequisites and the small amount of memory leaked per event.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.