CyberSecBulletin
CVE-2026-64188NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64188 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c4e676c3505c5058922dc1a6f1ded795f6758135, 9918698cf3aee4032e12bb42fd5a951dc465339b, 310b93246bfec7d4452507e0c15477377ed9f025 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c4e676c3505c5058922dc1a6f1ded795f6758135 or 9918698cf3aee4032e12bb42fd5a951dc465339b or 310b93246bfec7d4452507e0c15477377ed9f025 or 1078ae8175777e80c9637996fb4a46c55f0ce576, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.260 or 5.15.211 or 6.1.177 or 6.6.144, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, c4e676c3505c5058922dc1a6f1ded795f6758135; ceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, 9918698cf3aee4032e12bb42fd5a951dc465339b; ceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, 310b93246bfec7d4452507e0c15477377ed9f025; ceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, 1078ae8175777e80c9637996fb4a46c55f0ce576; ceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, 41e06fcc5df0774d212e70c5b503fc769492bce3; ceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, 8b17adf6d4fb6bf61fa4c3f58366a7c082799a71; ceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, f193e38cb257d033060b63f1cfd94af076b3a2ab; ceed73a2cf4aff2921802aa3d21d45280677547d up to, but not including, d00c953a8f69921f484b629801766da68f27f658; and 1 more rangesc4e676c3505c5058922dc1a6f1ded795f6758135, 9918698cf3aee4032e12bb42fd5a951dc465339b, 310b93246bfec7d4452507e0c15477377ed9f025, 1078ae8175777e80c9637996fb4a46c55f0ce576, 41e06fcc5df0774d212e70c5b503fc769492bce3, 8b17adf6d4fb6bf61fa4c3f58366a7c082799a71
LinuxLinux Kernel4.14 up to, but not including, 5.10.260; 5.11 up to, but not including, 5.15.211; 5.16 up to, but not including, 6.1.177; 6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.37; 6.19 up to, but not including, 7.0.14; 7.15.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egress_dev pointer. BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27) Call Trace: <TASK> __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101) rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096) __netif_receive_skb_one_core (net/core/dev.c:6208) netif_receive_skb (net/core/dev.c:6467) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2003) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) </TASK> Add an rcu_head field to struct rmnet_endpoint and replace kfree() with kfree_rcu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnet_vnd_dellink() call and inline only the nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set ep->egress_dev to NULL during the grace period, creating a data race with lockless readers.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.