GHSA-fjcx-ggvr-3wg6unknown

In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix...

Published
August 10, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (1)

📋 Description

In the Linux kernel, the following vulnerability has been resolved:

watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to default_gov.

If the governor being unregistered is currently set as default_gov, the default_gov is never cleared. This leads to 2 use-after-free issues:

  1. New watchdog devices registered after this point will inherit the dangling default_gov.
  2. Existing watchdog devices using the unregistered governor will have their wdd->gov reassigned to the dangling default_gov.

Fix the UAF by clearing default_gov if it matches the governor being unregistered.

🔗 References (10)