CVE-2026-74329 watchdog: unregister PM notifier on watchdog unregister
A use-after-free vulnerability in the Linux kernel watchdog subsystem allows local attackers to cause a denial of service or potentially execute code during suspend/resume events.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74329?
CVE-2026-74329 is an use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
watchdog: unregister PM notifier on watchdog unregister
watchdog_register_device() registers wdd->pm_nb when WDOG_NO_PING_ON_SUSPEND is set, but watchdog_unregister_device() does not remove it. This leaves an embedded notifier block on the PM notifier chain after the watchdog device has been unregistered.
A later suspend/resume notification can then call watchdog_pm_notifier() with a stale watchdog_device pointer, or at minimum after wdd->wd_data has been cleared by watchdog_dev_unregister().
Unregister the PM notifier before tearing down the watchdog device.
Which versions are affected by CVE-2026-74329?
How do I fix CVE-2026-74329?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-74329 being exploited?
There is no known exploitation of CVE-2026-74329 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74329, DEBIAN-CVE-2026-74329, GHSA-qx92-xvvw-qq6q, UBUNTU-CVE-2026-74329.