CVE-2026-90135

A flaw was found in the Linux kernel. A local user attempting to read from /sys/kernel/debug/ref_tracker/* could trigger a use-after-free vulnerability. This occurs due to a missing exit function call in alloc_netdev_mqs() when certain memory allocation or device initialization operations fail. Successful exploitation of this flaw could lead to a system crash, resulting in a denial of service.

A use-after-free can occur in the net device allocation failure path because alloc_netdev_mqs can free the net_device object without destroying its ref_tracker directory state. If alloc_percpu or dev_addr_init fails after ref_tracker setup, stale debugfs/ref_tracker state can remain and a later read of /sys/kernel/debug/ref_tracker/* may dereference freed memory and crash the kernel. For the CVSS the PR:L is used for the paranoid score because some environments may delegate network device creation or debugfs access to reduced capability users, container root, or service accounts, even though normal systems often require administrator privileges. The issue is not network reachable and requires local control of the allocation path and debugfs access. Impact is at least local denial of service via kernel crash and in worst case may allow limited confidentiality or integrity impact due to the UAF class, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.