CVE-2025-68762

In the Linux kernel, __netpoll_setup() initializes the work queue refill_wq only after performing error checks. When a device with the IFF_DISABLE_NETPOLL flag is encountered, the function fails early and calls skb_pool_flush() for cleanup. This function invokes cancel_work_sync(&np->refill_wq), but since the work queue was not initialized before the error check, an uninitialized work queue is accessed, triggering a kernel warning in __flush_work() [1].

The vulnerability is triggered during netconsole setup when a device has the IFF_DISABLE_NETPOLL flag. An attacker able to influence netconsole configuration or device flags could cause a kernel warning. The attack surface is limited to local users with sufficient privileges to configure netconsole or trigger device setup failures [1].

The impact is a kernel warning that can lead to system instability or denial of service, as warnings may cause system hangs or panic in certain configurations. An uninitialized work queue operation can also corrupt kernel memory, making this a potential security vulnerability [1].

The fix moves the INIT_WORK() call to the beginning of __netpoll_setup(), ensuring the work queue is properly initialized before any error checks. This allows the cleanup path to safely cancel the work queue regardless of where the setup fails. The patch is included in stable kernel updates [1].