Linux: Use After Free
CVE-2026-64073 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 2dc79362302922cb18f35e262712b5e58de65442, eef4f71b46a9929ac33e968538c9dd5d96a02460, 684a78183c54c23e70d1cba320f7fc184604210b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 2dc79362302922cb18f35e262712b5e58de65442 or eef4f71b46a9929ac33e968538c9dd5d96a02460 or 684a78183c54c23e70d1cba320f7fc184604210b or 18c0456ea2615b1a743a6db739c74411c3b42bc6, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.175 or 6.6.142 or 6.12.92 or 6.18.34, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 810979682ccc98dbd83f341c18a2e556c30a7164 up to, but not including, 2dc79362302922cb18f35e262712b5e58de65442; 810979682ccc98dbd83f341c18a2e556c30a7164 up to, but not including, eef4f71b46a9929ac33e968538c9dd5d96a02460; 810979682ccc98dbd83f341c18a2e556c30a7164 up to, but not including, 684a78183c54c23e70d1cba320f7fc184604210b; 810979682ccc98dbd83f341c18a2e556c30a7164 up to, but not including, 18c0456ea2615b1a743a6db739c74411c3b42bc6; 810979682ccc98dbd83f341c18a2e556c30a7164 up to, but not including, 81b582784518196eff1050212a046bc29d3a05dd; 810979682ccc98dbd83f341c18a2e556c30a7164 up to, but not including, 91840be8f710370607f949a627e070896faeddb8; 5.16 | 2dc79362302922cb18f35e262712b5e58de65442, eef4f71b46a9929ac33e968538c9dd5d96a02460, 684a78183c54c23e70d1cba320f7fc184604210b, 18c0456ea2615b1a743a6db739c74411c3b42bc6, 81b582784518196eff1050212a046bc29d3a05dd, 91840be8f710370607f949a627e070896faeddb8 |
| Linux | Linux Kernel | 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.1 | 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0. After irq_work_single() clears BUSY via atomic_cmpxchg(), it still dereferences @work for irq_work_is_hard() and rcuwait_wake_up(). An irq_work_sync() caller on another CPU that enters after BUSY is cleared can observe BUSY==0 immediately, return, and free the work before those accesses complete — causing a use-after-free. Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire irq_work_single() execution is within an RCU read-side critical section. Then add synchronize_rcu() in irq_work_sync() after rcuwait_wait_event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/18c0456ea2615b1a743a6db739c74411c3b42bc6
- git.kernel.org/stable/c/2dc79362302922cb18f35e262712b5e58de65442
- git.kernel.org/stable/c/684a78183c54c23e70d1cba320f7fc184604210b
- git.kernel.org/stable/c/81b582784518196eff1050212a046bc29d3a05dd
- git.kernel.org/stable/c/91840be8f710370607f949a627e070896faeddb8
- git.kernel.org/stable/c/eef4f71b46a9929ac33e968538c9dd5d96a02460
Recent Use After Free vulnerabilities
- 8.8 High severity
- 9.8 Critical severity
- 9.8 Critical severity
- 7.8 High severity
- 9.8 Critical severity
- 8.8 High severity
Spotted an error? Tell us.