staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

Summary

In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in the queue which might run after the cvm_oct_remove() frees net_device structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it iterates cvm_oct_device[] which is an array of netdevice pointers. Add tasklet_kill() after free_irq() to ensure the tasklet is no longer scheduled or running before teardown proceeds.

Timeline

1. Sep 24, 2026, 3:52 PM UTCCVE published
2. Oct 19, 2026, 9:08 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in 32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486; From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in d15226338dfaa84ffff142d32723cdf74d0c47c4; From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19; From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in b6365e4186322858a82c8713b1d0bd209c8e765a; From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in 03d12490afd1198310ad0aba42462329832eb739; From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in 2c0c9956596e48654bb4855e2a0742748a0826a7; From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in 41a79bd9e5a74f8f483b3b206d10567912874fb4; From 4898c560103fb8075c10a8e9d70e0ca26873075e · fixed in b9af44b0d20b2247c4eb0ea5cfca907d643eea50

• Linux Linux

  2.6.34

• KernelLinux

  From 2.6.34 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 8