CVE-2026-74264

This CVE reveals a design failure that should change how you evaluate similar refactoring in your own codebases. The vulnerability stems from a conversion that treated a reference tracker pointer as a stateless debugging aid when it had silently become a shared synchronization primitive accessed from multiple execution contexts. The original commit replaced untracked dev_hold/dev_put calls with tracked versions, presumably to catch reference leaks. This looked like a safe infrastructure improvement — adding instrumentation without changing behavior. But the tracker pointer (dev->watchdog_dev_tracker) was being accessed concurrently from netdev_watchdog_up() in process context and dev_watchdog() in timer context, with no mutual exclusion. The list_del corruption in ref_tracker_free was the symptom; the root cause was that nobody recognized these paths needed synchronization because the refcount tracking API presented itself as simple bookkeeping. The three-part fix is the red flag. First, adding watchdog_lock and watchdog_ref_held patches a concurrency hole after the fact. Second, removing netdev_watchdog_up() from netif_carrier_on() is a semantic change — drivers that previously armed the watchdog from interrupt context now cannot, which may cause silent failures under load. Third, the conditional tracker allocation and release logic in dev_watchdog() must distinguish whether the timer was rescheduled by itself, by netdev_watchdog_up(), or not rescheduled at all, then act differently in each case. This is exactly the kind of complex state machine that has produced kernel bugs repeatedly. Two open questions should inform your prioritization. First, verify that the watchdog_lock/tx_global_lock combination covers the entire check-then-allocate sequence for the tracker — the patch diff alone doesn't confirm this. Second, audit your drivers: any that call netif_carrier_on() from atomic context relied on implicit serialization that no longer exists and will fail silently under load. The ref_tracker allocator's list structures were implicitly trusted infrastructure; this corruption potentially poisoned memory that other subsystems still access without synchronization. Assume the blast radius exceeds what the CVSS 7.8 captures.

Reviewed through automated stages and approved by a human before publication.