CyberSecBulletin
CVE-2026-64543NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64543 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 380413cdfd29fb9fa486c82889132b680c4983c5, f05b3f4c78370469286879c765f5a1dd39dbcd32, 4da2ac7749411971e1b222b992da5a172ce45f98 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 380413cdfd29fb9fa486c82889132b680c4983c5 or f05b3f4c78370469286879c765f5a1dd39dbcd32 or 4da2ac7749411971e1b222b992da5a172ce45f98 or 5e215bf1c47fdddf8203a0fe80a0ed594065f101, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.265 or 5.15.216 or 6.1.183 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, 380413cdfd29fb9fa486c82889132b680c4983c5; 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, f05b3f4c78370469286879c765f5a1dd39dbcd32; 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, 4da2ac7749411971e1b222b992da5a172ce45f98; 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, 5e215bf1c47fdddf8203a0fe80a0ed594065f101; 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, ec7d54d8cc1723921d671e3272b427c96366506f; 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2; 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, b65289e1c3f352a9f92c6e19713ddd647e033253; 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 up to, but not including, 1579342d71133da7f00daa02c75cebec7372097b; and 1 more ranges380413cdfd29fb9fa486c82889132b680c4983c5, f05b3f4c78370469286879c765f5a1dd39dbcd32, 4da2ac7749411971e1b222b992da5a172ce45f98, 5e215bf1c47fdddf8203a0fe80a0ed594065f101, ec7d54d8cc1723921d671e3272b427c96366506f, a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2
LinuxLinux Kernel4.17 up to, but not including, 5.10.265; 5.11 up to, but not including, 5.15.216; 5.16 up to, but not including, 6.1.183; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.97; 6.13 up to, but not including, 6.18.40; 6.19 up to, but not including, 7.1.55.10.265, 5.15.216, 6.1.183, 6.6.145, 6.12.97, 6.18.40

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disable_l2_media(), but the UDP bearer defers that call to the cleanup_bearer() workqueue, so the discoverer is freed with no grace period: BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149) Read of size 8 at addr ffff88802348b728 by task poc_tipc/184 <IRQ> tipc_disc_rcv (net/tipc/discover.c:149) tipc_rcv (net/tipc/node.c:2126) tipc_udp_recv (net/tipc/udp_media.c:391) udp_rcv (net/ipv4/udp.c:2643) ip_local_deliver_finish (net/ipv4/ip_input.c:241) </IRQ> Freed by task 181: kfree (mm/slub.c:6565) bearer_disable (net/tipc/bearer.c:418) tipc_nl_bearer_disable (net/tipc/bearer.c:1001) The bearer is freed with kfree_rcu(); free the discoverer the same way. Add an rcu_head to struct tipc_discoverer and free it and its skb from an RCU callback. Because the RCU callback (tipc_disc_free_rcu) lives in module text, a call_rcu() that is still pending when the tipc module is unloaded would invoke a freed function. Add an rcu_barrier() to tipc_exit() after the bearer subsystem has been torn down, so all pending discoverer callbacks have run before the module text goes away. Reachable from an unprivileged user namespace: the TIPCv2 genl family is netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.