Use-after-free in Linux kernel - CVE-2026-64329
Published: July 27, 2026
Vulnerability identifier: #VU139651
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64329
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the ucsi_ccg_remove() remove path and threaded IRQ handler when handling connector-change events during device removal. A local user can trigger concurrent remove and IRQ activity to cause a denial of service.
The issue arises from a race condition where an in-flight IRQ handler may access a freed ucsi object.
How to mitigate CVE-2026-64329
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b
- https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5
- https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85
- https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9
- https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426
- https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8
- https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d
- https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9