Use-after-free in Linux kernel - CVE-2026-64188
Published: July 21, 2026
Vulnerability identifier: #VU138915
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64188
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in rmnet_dellink() and the rmnet endpoint handling in the Qualcomm rmnet driver when processing network packets on the receive path while an endpoint is being removed. A local user can trigger concurrent packet processing and endpoint deletion to cause a denial of service.
The stale read occurs when lockless RCU readers dereference the egress_dev pointer after the endpoint memory has been freed.
Affected software
Linux kernel
How to mitigate CVE-2026-64188
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/1078ae8175777e80c9637996fb4a46c55f0ce576
- https://git.kernel.org/stable/c/310b93246bfec7d4452507e0c15477377ed9f025
- https://git.kernel.org/stable/c/41e06fcc5df0774d212e70c5b503fc769492bce3
- https://git.kernel.org/stable/c/8b17adf6d4fb6bf61fa4c3f58366a7c082799a71
- https://git.kernel.org/stable/c/9918698cf3aee4032e12bb42fd5a951dc465339b
- https://git.kernel.org/stable/c/c4e676c3505c5058922dc1a6f1ded795f6758135
- https://git.kernel.org/stable/c/d00c953a8f69921f484b629801766da68f27f658
- https://git.kernel.org/stable/c/f193e38cb257d033060b63f1cfd94af076b3a2ab